How to Configure MTA-STS in Cloudflare
MTA-STS (SMTP MTA Strict Transport Security) allows receiving domains to publish a policy that tells sending servers to require TLS and validate the MX hosts against your policy, reducing TLS downgrade and misconfiguration risks. This guide shows how to host the policy on Cloudflare and publish the required DNS records.
What You Need
- A hostname
mta-sts.example.com serving HTTPS with a trusted certificate.
- Ability to host a plain text file at
/.well-known/mta-sts.txt.
- Access to Cloudflare DNS for publishing TXT records.
1) Set up mta-sts host
- Create a DNS record for
mta-sts.example.com pointing to your origin (Pages, Workers, or web server).
- Disable the Cloudflare proxy (set to DNS-only / grey cloud) to ensure end-to-end TLS with your certificate.
- Install an SSL/TLS certificate that covers
mta-sts.example.com.
2) Serve the policy file
Place a text file at https://mta-sts.example.com/.well-known/mta-sts.txt with contents like:
version: STSv1
mode: testing
mx: mail1.example.com
mx: mail2.example.com
max_age: 86400
Use mode: testing initially; switch to enforce once validated. Ensure the file is served with Content-Type: text/plain.
3) Publish the MTA-STS TXT record
Create a TXT record at _mta-sts.example.com:
_mta-sts.example.com. IN TXT "v=STSv1; id=2025-10-22"
Increment the id whenever the policy changes to signal senders to re-fetch.
4) (Optional) Enable TLS-RPT
Create a TXT record at _smtp._tls.example.com to collect TLS reports:
_smtp._tls.example.com. IN TXT "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"
5) Verify configuration
- Fetch policy:
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
- Check TXT:
dig TXT _mta-sts.example.com +short
- Validate MX TLS:
openssl s_client -connect mail1.example.com:25 -starttls smtp -servername mail1.example.com -showcerts
Cloudflare Tips
- For Cloudflare Pages, deploy a simple static site that serves the policy path; add a custom domain
mta-sts.example.com.
- Avoid caching or redirects that alter
/.well-known/mta-sts.txt path.
- Keep the proxy off for the mta-sts host to present your origin certificate directly.
Troubleshooting
- Policy not reachable: confirm DNS, TLS certificate, and that the path is exact.
- MX mismatch: ensure the
mx: entries match the hostnames in your MX records.
- Sender refuses enforce: check TLS chain, hostname matches, and ensure modern TLS versions are supported.
Once validated, set mode: enforce and monitor TLS-RPT to catch delivery issues early.
