Understanding MTA-STS for Custom Domains
MTA-STS (Mail Transfer Agent Strict Transport Security) is an internet standard (RFC 8461) that secures inbound email delivery by strictly enforcing TLS encryption between email servers. Currently, Thundermail enforces and manages complete MTA-STS policies natively for primary @thundermail.com addresses. However, automated support for custom domains is still pending.
This guide explains how to handle the _mta-sts TXT record provided in your custom domain setup instructions.
Option 1: Skip or remove the _mta-sts TXT record (Recommended)
We recommend omitting or deleting the _mta-sts TXT record from your custom domain's DNS configuration.
Will this impact email deliverability?
Nope! Removing or skipping this record has zero negative impact on your email deliverability or security. Standard TLS encryption, SPF, DKIM, and DMARC will remain fully active as long as their associated records remain published.
Why omit it?
Publishing an unmanaged TXT record without hosting the accompanying HTTPS web endpoint effectively isn't doing anything and may cause friction in the future if you ever migrate DNS providers.
Option 2: Self-host the policy file
If you require (or desire) MTA-STS enforcement, you can self-host the plain-text policy file (.well-known/mta-sts.txt) on your own external web server and provision your own TLS certificate for mta-sts.example.com .
Please note: As self-hosting the policy file requires managing external hosting and SSL/TLS certificates, Thundermail support is limited in the assistance they can provide with setting up or troubleshooting third-party infrastructure.
Frequently Asked Questions
How does MTA-STS work?
For MTA-STS to function, it requires two distinct pieces working together:
- A mta-sts DNS TXT record: Published at mta-sts.example.com, this acts as a public announcement that tells sending mail servers, "Hey! I have an active MTA-STS policy you must check before delivering to me!"
- A HTTPS web endpoint with a policy file: A web server at https://mta-sts.example.com/.well-known/mta-sts.txt that responds to the sending mail servers over a valid SSL/TLS certificate with the actual security rules within the policy that's been set.
If you have one piece without the other, it's not really going to do anything at all. Sending email servers will either see the record and find no policy to match it to, or won't know to check for the policy if the record is missing.
Why is there an _mta-sts TXT record in my setup checklist?
The _mta-sts record appears in your setup wizard for one main reason: to empower our Thundermail users who are looking to set up and self-host the HTTPS web endpoint policy. It is completely optional.
Why isn't custom domain MTA-STS automated by Thundermail?
Automating the HTTPS web endpoint requires procuring, validating, and rotating 90-day SSL/TLS certificates across every custom domain on our platform. With that timeline dropping down to 47 days by 2029 and this being a massive infrastructure complexity, many email providers do not automate custom domain MTA-STS management either.
Why is the id value in the checklist template identical across domains?
Per RFC 8461 §3.1, the id string (e.g., 18139500144460329770) is a policy version tracking identifier used by sending mail transfer agents (MTAs) to detect when a policy file changes. It is a standard template artifact, not a domain-unique signature or secret key.