Hosted MTA-STS
We host your MTA-STS record, policy and certificate.
MTA-STS tells senders to deliver your mail only to your named MX hosts, over verified TLS. It needs a DNS record, a policy file on an HTTPS host with a valid certificate, and a policy ID that changes with every edit. Point your DNS records at us and we host these for you.
- MX list read from your DNS
- Testing before enforce
- Fails open
Test your policy before you enforce it
Choose the mode from your dashboard. Check the MX hosts we read from your DNS and the policy file we're serving.
View full screenshot View full screenshot
Choose the mode
Start in testing mode. You decide when to switch to enforce.
Check your mail hosts
The MX list comes from your domain's DNS. The served policy lists those hosts.
Delegate the record and the policy host
MTA-STS has two halves, and both have to be delegated or the policy still needs a hand edit every time it changes.
-
STEP 1
Switch to hosted MTA-STS
On the domain's MTA-STS page, press Switch to hosted MTA-STS. We read your MX hosts from DNS at that moment and write the first policy in testing mode.
-
STEP 2
Publish the CNAMEs
_mta-stsfor the record andmta-stsfor the policy host. We give you both values and check until both resolve. -
STEP 3
Confirm the MX list, then enforce
Check the hosts on the card against what receives your mail. Press Refresh from DNS if they've changed. Then move the mode to enforce.
The record, the file and the certificate
We serve every piece a sender checks, at your own hostnames.
Served at your own hostnames
The TXT at _mta-sts, the policy file at
https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, and a
certificate valid for that hostname. You publish two CNAMEs and we run the rest.
We update the policy ID with each edit
Senders re-fetch the policy when the record's ID changes. We update it whenever you save an edit.
Your MX hosts, from your DNS
The policy's mx lines come from your live MX records and sit
on the card for you to confirm. Add a mail host, press Refresh from DNS,
and the policy follows.
Testing first
In testing, every message still delivers even when a check fails. If you move to enforce before the policy is live, we ask you to confirm. Senders hold to the MX list the moment they can fetch it.
How long senders cache the policy
Senders cache the policy for 1 day in testing and 2 weeks in enforce. An enforce mistake can last 2 weeks in a sender's cache.
Back to testing in one save
Switch back to testing if enforce breaks a relay. We update the policy ID, and senders that re-check pick the change up at once.
What happens if we're unreachable
If our DNS or the policy host is unreachable
Senders keep the policy they cached, and once it expires they fall back to ordinary TLS. Mail still delivers, without MTA-STS protection.
If your plan lapses
The record and the policy keep serving exactly as they stand. Only the mode control locks. Stop hosting and the card hands you the record and the policy text to publish yourself.
Stop hosting whenever you want
To drop MTA-STS, delete the two CNAMEs. Senders fall back to ordinary TLS when their
cached policy expires. To keep it self-managed, publish your own TXT with a new id,
serve your own policy file at mta-sts.yourdomain.com, and delete both
CNAMEs last. We keep answering both names until you remove them, and for 20 days
afterward. Then we retire the records and the certificate.
Plans
Part of the Business plan and up
Hosted MTA-STS includes the Monday digest, same-day alerts and sender evidence. Try every feature of the Business plan for 30 days, no card.
Business
$49 /month
10 domains
Portfolio
$79 /month
25 domains
Works alongside
Where to go next
FAQ
Questions people ask first
What is MTA-STS?
A policy your domain publishes to tell every sending mail server two things: use TLS to reach me, and here are the only hosts allowed to receive my mail. Without it, a sender that can't negotiate TLS falls back to plaintext, and anyone on the path can make that happen on purpose.
Do I need it if I use Google Workspace or Microsoft 365?
The policy is published by your domain, whichever provider receives the mail. Both providers' MX hosts speak TLS, so the policy lists those hosts and senders hold to them. Neither provider publishes the policy for you.
What's the difference between testing and enforce?
In testing, every message still delivers, even when a check fails. In enforce, a sender refuses to deliver to a host that isn't on your MX list or can't present a valid certificate. Start in testing, confirm the MX list, then enforce.
Why is hosting the policy the hard part?
The file has to sit on an HTTPS host named mta-sts.yourdomain.com, with a certificate for that exact name renewed before it expires, and the DNS record's id has to change every time the file does. That's a web server and a certificate kept alive for one text file. We run it for you.
What about TLS-RPT?
TLS-RPT is the reporting half: a TXT at _smtp._tls with the address where senders mail their TLS failure reports. We read those reports. Your domain's MTA-STS page gives the record to publish and shows whether reports arrive. On the Business plan and up, it lists the failures by mail server and result, and the weekly digest counts them. Hosting covers the policy only, so you publish this record yourself.
What happens if DomainCanary is down?
Senders keep the policy they cached, and when it expires they fall back to ordinary TLS. Your mail still delivers. MTA-STS fails open by design, and hosting it with us keeps that.
How long does an enforce mistake last?
The policy caches for 1 day in testing and 2 weeks in enforce. When you switch back to testing, we update the policy ID. Senders that re-check pick the change up at once. A sender that doesn't re-check keeps enforcing until its cached copy expires.
What does it cost?
It's part of the Business plan and up. The Business plan is $49 a month for 10 domains and the Portfolio plan is $79 for 25. Try every feature of the Business plan free for 30 days, no card needed.
Let us host your MTA-STS policy
We read your MX hosts, write the policy in testing, and carry the certificate for your own hostname. You confirm the list and pick the mode.
First domain free · 30 days on the Business plan · No card
- The record, the policy file and the certificate, at your names
- We update the policy ID on every edit
- Testing first, enforce on confirmation, back in one save
- Fails open: senders fall back to ordinary TLS