Definition
MTA-STS allows receiving domains to publish a policy requiring valid TLS for supported SMTP server-to-server delivery.
How it works
A DNS _mta-sts record announces an HTTPS policy served at mta-sts.domain, with a mode, cache lifetime and allowed MX hosts. Supporting senders discover and cache that policy.
Real-world example
When migrating MX hosts, update the policy before cutover to avoid rejected deliveries by senders enforcing a cached policy.
Limits and best practices
Use TLS-RPT for reports, monitor certificates and renewals, and test policy behavior before switching to enforce.
Technical detail
The max_age parameter defines how long a supporting sender may cache the policy. Before changing MX hosts, publish the updated configuration early and monitor TLS-RPT reports for delivery failures.