SentraDMARC

MTA-STS and TLS-RPT

Both protect mail sent to you. MTA-STS (Business and above) tells sending servers to deliver to you only over encrypted, authenticated connections. TLS-RPT (all plans) gets those servers to report when that fails.

TLS-RPT

Added during setup as a CNAME at _smtp._tls. Sending servers that support it (Google and Microsoft among them) send a daily report, as JSON over email, of their connections to your mail servers: how many sessions used TLS successfully, and the failures by cause, such as an expired certificate, a certificate that does not match the server name, a server that does not offer STARTTLS, or an MTA-STS policy that could not be fetched. Reports arrive only when other servers actually deliver mail to you. The TLS-RPT page shows the success rate, the daily volume, and the failures by cause, and exports them as CSV.

MTA-STS

The two CNAMEs

  • _mta-sts (with the underscore) carries the policy version. Senders read it first, and its id tells them when your policy changed.
  • mta-sts (no underscore) is the HTTPS host senders fetch your policy file from. It points at the policy host shown in your dashboard.

Both are asked for in the setup wizard on Business and above.

The certificate

Senders fetch your policy over HTTPS from mta-sts. your domain, so that host needs a certificate. SentraDMARC issues none. Traefik, the proxy in front of our policy server, obtains one on the first HTTPS request for your mta-sts host, which can only happen once your CNAME resolves to us, usually within the hour. Until then the page says the host is not answering over HTTPS yet. We check the certificate's dates and raise an alert 14 days before it expires, and again if it does.

Testing, then enforce

  • Testing, where every domain starts: senders report failures through TLS-RPT but still deliver.
  • Enforce: senders that honour MTA-STS refuse to deliver to a server that is not on your list or cannot present a valid certificate.

Move to enforce once your TLS reports are clean. The dashboard refuses enforce while the MX list is empty, while either CNAME does not point at us, or while your policy cannot be fetched over HTTPS.

The MX list

The policy lists the mail servers allowed to receive your email, such as *.mail.protection.outlook.com. Auto-Discover fills it from your current MX records. Under enforce, an incorrect pattern blocks your incoming mail, so check the list whenever you change mail provider. If your MX records stop matching the policy, you get an alert ("MTA-STS policy no longer matches your mail servers").

The cache window

Senders keep your policy for its max_age before fetching it again: from 1 day to 6 months. Longer is stronger, but nothing can recall a policy a sender already holds, so stepping back from enforce takes that long to reach everyone.