We auto-provision MTA-STS policies and certificates for every DNS-hosted domain

Quick show of hands: how many of your domains have MTA-STS configured?

If you're not sure what MTA-STS is, that kind of proves the point. It's one of those standards that's important for email security but painful enough to set up that almost nobody does it.

What MTA-STS does

When a mail server wants to deliver email to your domain, it looks up your MX records and connects over SMTP. SMTP supports STARTTLS for encryption, but it's opportunistic by default. A man-in-the-middle can strip the STARTTLS offer from the connection and force a plaintext downgrade. The sending server doesn't know the difference because there's no way to signal "I require TLS" through DNS alone (DANE does this, but requires DNSSEC on both sides, which limits adoption).

MTA-STS (RFC 8461) solves this. You publish a policy file at a specific HTTPS URL on a subdomain of your domain, plus a DNS TXT record that tells sending servers to fetch the policy. The policy says "when delivering mail to my domain, you must use TLS, and here are the MX hostnames you should expect." If the TLS connection fails or the MX doesn't match, the sending server should refuse to deliver rather than fall back to plaintext.

Why nobody sets it up

To configure MTA-STS manually, you need to:

1. Create a subdomain: mta-sts.yourdomain.com
2. Get a valid TLS certificate for that subdomain
3. Configure a web server to serve the policy file over HTTPS
4. Write the policy file with the correct MX hostnames and mode
5. Publish a _mta-sts TXT record in DNS with a version identifier
6. Renew the certificate before it expires
7. Update the policy file and DNS record if your MX records change

That's a lot of moving parts for something most people have never heard of.

What we do

When you enable DNS hosting for a domain on RacterMX, we handle all of it automatically:

• Provision the mta-sts subdomain
• Obtain and renew the TLS certificate via Let's Encrypt
• Generate and serve the policy file with the correct MX hostnames
• Publish the _mta-sts DNS TXT record
• Keep everything in sync if your MX configuration changes

You don't configure anything. You don't even know it's there unless you look for it. Your domain just quietly gets protection against TLS downgrade attacks.

The provisioning runs every 6 hours

New domains get picked up automatically. Certificate renewals happen before expiration. If your MX records change, the policy file updates to match. It's a background process that you never have to think about.

Checking your domains

If you're curious whether your domains have MTA-STS, you can check with:

curl https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
dig TXT _mta-sts.yourdomain.com

If both return valid results, you're covered. If not, you're vulnerable to downgrade attacks on inbound mail delivery.

How many of your domains have MTA-STS configured today? And for those that do, did you set it up manually or does your provider handle it?