A TXT record announces that a policy exists. It does not contain the policy. That distinction is the whole of MTA-STS, and misunderstanding it is why domains publish the record, stop there, and wonder why mail is still being downgraded.
Where the policy actually lives
RFC 8461 section 3.2 defines the policy as a set of key/value pairs served over HTTPS GET from a fixed well-known path, at a host constructed by prepending mta-sts to the policy domain:
https://mta-sts.example.com/.well-known/mta-sts.txtThe TXT record at _mta-sts.example.com only advertises that a policy exists and carries an id for cache invalidation. If the HTTPS fetch fails, there is no policy — the TXT record alone enforces nothing.
The RFC also specifies a media-type check: senders SHOULD validate the response is text/plain. That guards against a web server letting untrusted users host arbitrary content at a path — if a policy endpoint can be made to return HTML, the policy format is being trusted from a channel that was never designed for it.
The three modes
The policy contains these keys:
- version — currently only
STSv1. - mode —
enforce,testing, ornone. - max_age — plaintext non-negative integer seconds, maximum 31557600 (one year).
- plus MX host patterns that define which servers are acceptable.
testing means a validation failure gets reported but the message still goes out over whatever TLS it managed. enforce means a sender that cannot establish a validated TLS connection to an authorised MX must not deliver. none is the explicit withdrawal.
That middle mode is where most domains sit, sometimes for years, and it is the single most useful thing to check when someone asks why an active downgrade is not being blocked. Reporting is not enforcement.
max_age is a cache control, and it cuts both ways
The maximum is exactly 31557600 seconds. Publish that and a sender caches your policy for a year. If you later need to change MX hosts during an incident, a year-long cache means the change is ignored until the cache expires — a self-inflicted outage window.
A few days is a defensible default for an actively maintained domain. The trade-off is more HTTPS fetches, which is cheap. The trade-off on the other side is being unable to respond to an incident, which is expensive.
Section 8.3 of the RFC covers removing MTA-STS entirely, and it is worth reading before you do it: lowering to none and letting cache expire is the graceful path, not deleting the records and hoping.
TLS-RPT is the other half
Reporting is what makes testing mode useful at all. TLS reporting tells you which senders attempted delivery, which failed validation, and why — wrong hostname, expired certificate, no matching MX. Without it, a policy published in testing mode is a promise nobody is checking.
The pattern that actually works: publish the report record, run in testing for long enough to see clean reports, then move to enforce, then consider raising max_age. Skipping the observation window is how a domain ends up enforcing a policy that excludes a legitimate partner MTAs and silently drops their mail.
What this means for a disposable inbox domain
For a domain that receives mail rather than sends it, MTA-STS on the receiving side protects senders delivering to you. If your MX hosts do not support TLS properly, publishing enforce will cause compliant senders to stop delivering rather than downgrade — which is the stated goal and also a delivery outage if your TLS is not ready.
For a domain used for outbound testing mail, the relevant question is whether the receivers you care about publish MTA-STS in enforce mode. If they do, your test SMTP client must actually negotiate TLS to their published MX hosts, not to whatever the MX record said five minutes ago. A local mail sink sidesteps all of this, which is exactly why it is the wrong instrument for testing real delivery.
The takeaway
A TXT record announces; the HTTPS well-known file enforces. Three modes, and only enforce blocks a downgrade. max_age caps at 31557600 and is really an incident-response dial. Turn on reporting before turning on enforcement, and treat MTA-STS as a live configuration you can change quickly rather than a record you set once.