Understand MTA-STS and TLS reporting

MTA-STS lets a receiving domain publish a policy for authenticated, encrypted SMTP transport. TLS reporting helps reveal delivery failures involving transport security. These complement SPF, DKIM and DMARC; they solve different problems.

1. Select Mail transport in the checker. It requests TXT records at _mta-sts.domain and _smtp._tls.domain.
2. For MTA-STS, compare the v=STSv1 discovery record and id= with your provider’s settings. The policy also needs a valid HTTPS file at the prescribed MTA-STS location. The DNS record alone is insufficient.
3. Deploy and test the policy with your provider before enforcing it. Its MX patterns, certificate coverage and cache lifetime must match the receiving service.
4. For TLS reporting, confirm the v=TLSRPTv1 record and reporting destinations. Use destinations you control or that your reporting provider explicitly supplies.
5. Review reports after mail-host changes and certificate renewals. Update the MTA-STS policy identifier when changing the policy.

The checker does not fetch policy files, visit reporting URLs, send reports or connect to SMTP servers. A missing optional transport policy does not by itself explain why ordinary mail cannot arrive.

References: MTA-STS and TLS reporting.