DNS Record Explainer

v=STSv1
Policy version. Currently only STSv1 exists. This tag is mandatory and must always be present.

id=20260417T000000
Policy ID in YYYYMMDDTHHmmss format. Used to track policy changes. Clients cache policies and check this ID on refresh—if it differs, they fetch the new policy file. The value itself (the timestamp) is arbitrary; what matters is that you increment it whenever you publish a new policy. This tag is mandatory.

This MTA-STS policy record is incomplete and non-functional. A valid policy requires two additional mandatory tags:

• mx — specifies which mail servers are authorized to receive mail for your domain. Example: `mx=mx1.example.com` or `mx=*.example.com` (wildcard allowed). You must include at least one.

• max_age — how long (in seconds) receivers should cache this policy before re-fetching. Typical range: 604800 (1 week) to 31536000 (1 year). Mandatory.

Without these, the policy doesn't enforce anything. A minimal valid record looks like:
`v=STSv1; id=20260417T000000; mx=mail.example.com; max_age=604800`

Also note: MTA-STS policies live in a `.well-known/mta-sts.txt` file on your domain, not in DNS itself. This DNS record is just the pointer announcing that the policy exists. The actual enforcement rules (mx list, mode) go in the HTTPS-served file.

MTA-STS tells other mail servers to enforce encryption and verify certificates when connecting to your MX hosts. Without a complete policy, remote servers won't know which hosts to trust or how aggressively to enforce the policy. This record alone signals you have an MTA-STS setup, but without the mx and max_age tags, it's a broken announcement that will be rejected by compliant validators.

→ /blog/mta-sts-explained