DNS Record Explainer

v=STSv1
Version tag. Tells clients this is MTA-STS v1 format. Required, always this value.

id=20260417T000000
Policy ID. Timestamp in YYYYMMDDThhmmss format. Used to track policy freshness and cache validity. When you issue a new policy, increment this (change the timestamp). Clients compare it against cached versions to know whether to fetch a fresh copy. The date here (2026-04-17) is in the future, which works—there's no requirement it match deployment date.

This is a bare minimum MTA-STS policy. It's missing the required mode directive.

mode=enforce (or mode=testing or mode=none) must be present. Without it, the policy is invalid and clients will reject it.
• enforce: mail servers must refuse delivery if STARTTLS fails or cert validation fails. Breaks mail delivery to non-compliant recipients or broken configs.
• testing: clients report failures via TLSRPT but deliver anyway. Safe for pilots.
• none: policy exists but enforcement is off (rare, for transitioning away).

Also missing: mx directive(s). At minimum, you need mx=mail.example.com; to declare which hostnames handle mail for your domain. Without it, clients have no idea which servers to trust.

Best practice version looks like:
v=STSv1; id=20260417T000000; mode=enforce; mx=mail.example.com; mx=mail2.example.com;

You can also add max_age=604800; (cache lifetime in seconds, default 604800 = 1 week).

MTA-STS lives at .well-known/mta-sts.txt on your domain and is discovered via DNS MTA-STS TXT record. It hardens mail delivery by forcing encrypted + authenticated connections. Without mode and mx, receiving servers ignore the policy entirely—you get zero protection.