SMTP TLS Reporting¶
What is SMTP TLS Reporting?¶
Much like HSTS makes TLS mandatory when using HTTP, MTA-STS makes encryption mandatory in SMTP, where it is currently optional. SMTP TLS Reporting, known as TLS-RPT for short, asks the servers sending mail to us to report how those connections went, so we can find out if we have any issues before we enforce our MTA-STS policy.
Getting Started¶
Create your policy¶
The first step to setting up MTA-STS is to publish your policy. It tells servers sending mail to your domain which of your mail servers to expect, and what to do if a secure connection to one of them cannot be established. An example policy can be seen here:
version: STSv1
mode: testing
mx: in1-smtp.messagingengine.com
mx: in2-smtp.messagingengine.com
max_age: 604800
The version value can only be STSv1 and the mode value can only be one of testing, enforce or none.
testing - senders deliver the email whether MTA-STS passes or fails. Their reports count successful sessions and the ones that would have failed. This is highly recommended as your starting value.
enforce - senders do not deliver the email if the mail server does not match an mx line or if a secure connection cannot be established. Their reports count successful sessions and the ones that failed.
none - senders treat your domain as having no policy. Use it to retire MTA-STS: publish mode: none with a short max_age such as 86400, update the id in your DNS record so senders fetch it, and keep it published until the old max_age has passed so cached enforce policies expire. Only then remove the policy and record. Reporting is separate from the policy, so if you keep your TLS-RPT record, reports can still arrive, with sessions recorded as no-policy-found.
max_age - the number of seconds that senders should cache and apply this policy for. The example uses one week. The RFC expects weeks or more, because a sender keeps applying a cached policy even if your policy host goes down, so keep it at least this long once you enforce.
This policy needs to be published on your website at a specific address. This is an example of a published policy address, located here:
https://mta-sts.scotthelme.co.uk/.well-known/mta-sts.txt
Activate your policy¶
Your policy is activated by publishing a DNS record:
_mta-sts.scotthelme.co.uk. 299 IN TXT "v=STSv1; id=1565808194"
The v value can only be set to STSv1 and the id value has to be a unique id that represents this policy and changed when you change your policy.
Enable reporting¶
To enable SMTP TLS reporting you must add another DNS record:
_smtp._tls.scotthelme.co.uk. 300 IN TXT "v=TLSRPTv1;rua=mailto:{subdomain}-d@tlsrpt.report-uri.com"
The v value should be set to TLSRPTv1, which is the only valid value, and rua contains the location you'd like to send reports to.
Useful Links¶
https://scotthelme.co.uk/improving-email-security-with-mta-sts/
https://scotthelme.co.uk/launching-smtp-tls-reporting/
Start Monitoring with Report URI¶
Already collecting TLS-RPT reports with us? Find your reporting address on Setup, or view your SMTP TLS reports.
New to Report URI? Create an account, then grab your unique TLS-RPT reporting address from the Setup page to use in your policy.