MTA-STS · TLS-RPT · hosted in Switzerland

Email to your domain encrypted only – with MTA-STS

MTA-STS (RFC 8461) requires other mail servers to deliver email for your domain only with encryption and only to your real mail servers. igs.ch hosts the policy for you: you set three DNS records, igs.ch takes care of the rest.

Start for free Learn more at igs.ch

The problem: encryption is optional for email

Mail servers encrypt delivery with STARTTLS – but only if both sides take part. An attacker on the network can suppress the offer to encrypt (downgrade) or redirect the connection to a fake server. The sending server does not notice and delivers in plain text.

The solution: a binding policy

With MTA-STS you publish a policy at https://mta-sts.<your-domain>/.well-known/mta-sts.txt. It names your mail servers and the mode:

testing – senders report problems but keep delivering.
enforce – senders deliver only with encryption to the listed mail servers with a valid certificate.
none – the policy is withdrawn.

A TXT record _mta-sts with an id tells senders that a policy exists and when it changed. Senders keep the policy for the duration of max_age.

TLS-RPT: you find out whether it works

With TLS-RPT (RFC 8460), providers such as Google and Microsoft send a daily report: how many connections were encrypted and which errors occurred. You see problems before switching to enforce.

How igs.ch hosts your MTA-STS

Flow: CNAME and TXT records at the customer, policy at igs.ch, senders check policy and certificate, TLS-RPT reports back to igs.ch

Set three DNS records: mta-sts as a CNAME to mta-sts.igs.ch, _mta-sts as TXT with the id and _smtp._tls as TXT for the reports.
igs.ch takes care of: the certificate, serving the policy, the list of your mail servers from the MX records (compared hourly) and evaluating the TLS-RPT reports.
Start in testing mode: once the signed reports show no errors for 14 days, igs.ch recommends switching to enforce.

Operation and security

Policies are files served without a database.
A short outage has no effect on delivery: senders keep using the stored policy.
An emergency brake prevents an error from changing many policies at once; a self-check fetches every policy hourly.
Operated in Switzerland by Hunkeler Digital Services.

Frequently asked questions

Do I need MTA-STS if I have DMARC?: Yes, they complement each other: DMARC protects against forged senders of your domain, MTA-STS protects email to your domain in transit.
What does hosted MTA-STS cost?: It is included in the Project plan; igs.ch also evaluates TLS-RPT reports in the Free plan.
Is email lost if something is wrong?: In testing mode, never. In enforce mode, senders only reject delivery if no encrypted path to one of your mail servers is possible – that is why igs.ch switches only after 14 days without errors.
Where can I see my policy?: At https://mta-sts.<your-domain>/.well-known/mta-sts.txt.