webzod
account

Switch MTA-STS from testing to enforce

email.mta_sts.mode_testing · effort: about an hour

Why it matters

In testing mode senders report TLS problems but still deliver, so a downgrade attack is not blocked. Enforce mode makes senders refuse to deliver over an insecure connection.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Read the TLS-RPT reports from the last few weeks. There must be no failures caused by your own mail servers, such as certificate name mismatches or expired certificates.
  2. Check that the mx: lines cover every MX host (including backup MX hosts) and that each one has a valid public certificate matching its own hostname. In enforce mode, mail to a host that fails this is not delivered. Replace the mx lines in the snippet with your own MX host names, written exactly as in your MX records.
  3. Change mode: testing to mode: enforce in the policy file, then change the id in the _mta-sts TXT record. Update the file before the TXT record.
  4. Keep max_age at 86400 for the first week so a mistake expires quickly, then raise it to a week or more (604800 or higher). To roll back, set mode: testing or none and change the id. Senders check the TXT id before they give up on a message and then fetch the new policy, but a sender may not see the new id until the TXT record's TTL has passed, so keep that TTL short during the rollout.
text 
# Policy file https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: YOUR-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 86400

# Then change the id (this record is edited, not added)
_mta-sts.example.com.  IN TXT  "v=STSv1; id=2026101001"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.