DNS Record Explainer

This is an MTA-STS (Mail Transfer Agent Strict Transport Security) policy record, delivered via DNS TXT lookup at _mta-sts.yourdomain.com.

• v=STSv1 — policy version. STSv1 is the only version in use. Required.
• id=20260417T000000 — timestamp that changes whenever the policy updates. It's not a validity date; it's how mail servers detect new versions. When you change your policy, increment this. Required.

The record itself is truncated—it's missing the actual policy directives. A complete MTA-STS policy lives in a separate HTTPS endpoint (at mta-sts.yourdomain.com/.well-known/mta-sts.txt), not in DNS. This DNS TXT record is just a pointer that advertises the policy exists and its version.

• **Incomplete as written.** This DNS record alone does nothing. You must also:
— Publish the full policy at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
— That file contains mode (enforce/testing), max_age, and MX matching rules
— Serve it with Content-Type: text/plain and valid HTTPS cert
• **Timestamp format looks plausible but verify it's yours.** The id value should be something you control and increment. Using a fixed date like 20260417 suggests this might be a template or test value—confirm it's intentional.
• **No TLSRPT policy detected.** While not required, you should also publish a TLSRPT policy (dns TXT at _smtp._tls.yourdomain.com) to receive reports when senders fail to apply MTA-STS. Without it, you're flying blind on adoption.

MTA-STS tells other mail servers "when sending to me, use TLS and verify my MX hostnames against my cert." Without this DNS record and the backing HTTPS policy, senders have no signal to enforce encrypted delivery, and they'll fall back to plaintext SMTP if your MX is unavailable or cert-mismatched.

→ /blog/mta-sts-explained