To deploy MTA-STS on an Apache VPS, publish an _mta-sts DNS TXT record, serve a valid policy at https://mta-sts.example.com/.well-known/mta-sts.txt, and publish a separate _smtp._tls TXT record for TLS reports. Start with mode: testing, review the JSON reports, correct every delivery or certificate problem, then change the policy to enforce and update its id.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The HTTPS endpoint must have a publicly trusted certificate for the exact mta-sts hostname, return HTTP 200 without a redirect, and send the policy as text/plain. Apache can provide that endpoint with an Alias and a MIME-type rule while your normal mail servers continue handling SMTP.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What MTA-STS protects and what TLS reporting adds
MTA-STS, defined in RFC 8461, lets a receiving domain tell sending mail systems which MX hosts may receive mail and what to do when encrypted SMTP cannot be established safely. It addresses downgrade and certificate-validation failures that ordinary opportunistic STARTTLS can otherwise tolerate.
The mechanism has two discovery steps. A sender first looks up a TXT record at _mta-sts.example.com. That record identifies the current policy version. The sender then fetches the policy over HTTPS from https://mta-sts.example.com/.well-known/mta-sts.txt. The policy is not served from the MX host and is not fetched over HTTP.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
TLS reporting, defined in RFC 8460, is independent. A sender looks up _smtp._tls.example.com and sends JSON summaries to the address or aggregation endpoint named by its rua value. TLSRPT can show failures even when the message was ultimately delivered, making it the feedback loop you need before enforcing MTA-STS.
| Mechanism | DNS name | Purpose | What the sender does |
|---|---|---|---|
| MTA-STS discovery | _mta-sts.example.com |
Finds the policy and its current identifier | Fetches the HTTPS policy and applies its mode, MX patterns and certificate rules |
| MTA-STS policy | https://mta-sts.example.com/.well-known/mta-sts.txt |
Declares permitted MX hosts and enforcement behavior | Requires HTTP 200, trusted TLS and a plain-text body; it must not follow a 3xx redirect |
| SMTP TLS reporting | _smtp._tls.example.com |
Publishes a destination for aggregate failure reports | Sends JSON containing connection results and policy failures |
Behavior in each MTA-STS mode
- testing: senders may continue delivery when the policy cannot be met, but TLSRPT-capable senders can report the failure.
- enforce: a sender must not deliver to an MX that is outside the declared patterns, lacks STARTTLS, or presents a certificate that fails validation.
- none: the domain is not asking senders to apply MTA-STS requirements. Use this only when intentionally withdrawing a policy.
MTA-STS implementations must support TLS 1.2 or TLS 1.3 or higher. The policy therefore strengthens SMTP TLS authentication and downgrade resistance; it does not replace ordinary mail-server TLS configuration, DNSSEC, spam controls or mailbox security.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Prerequisites on the VPS and in DNS
Choose the policy hostname and certificate first
For a domain such as example.com, use mta-sts.example.com as the policy host. Create a publicly resolvable DNS name and obtain a publicly trusted certificate whose subject alternative name covers that exact hostname. A certificate valid only for example.com or mail.example.com is insufficient.
The VPS needs Apache with HTTPS support, permission to edit its virtual-host configuration, and a way to renew the certificate before expiration. Keep the policy endpoint separate from your SMTP service; Apache only serves the HTTPS file.
Publish the discovery records
Add the following records at your authoritative DNS provider. Replace the example domain and mailbox with your own values.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Name | Type | Example value | Notes |
|---|---|---|---|
_mta-sts.example.com |
TXT | v=STSv1; id=2026101501 |
The id identifies the policy version. Change it whenever the HTTPS policy changes. |
_smtp._tls.example.com |
TXT | v=TLSRPTv1; rua=mailto:[email protected] |
Use one or more comma-separated rua destinations when your reporting design requires them. |
example.com |
MX | Your real mail exchangers | Every MX that can receive mail must match a policy mx: pattern when enforcement is enabled. |
DNS caching means a newly published record may not be visible everywhere immediately. Confirm that the authoritative servers return the intended values and allow normal resolver TTLs to expire before diagnosing a sender that still sees an older record.
Plan the report destination
Create [email protected] only if that mailbox can accept aggregate JSON reports reliably. Reports may arrive from many organizations and can contain hostnames, timestamps and failure details. Route them to a monitored mailbox or an aggregation system that can parse RFC 8460 JSON, retain historical data and alert on new failures. Do not publish an address that silently discards messages.
Create the policy file
Store the file outside a user-uploadable web directory, for example at /var/www/mta-sts/.well-known/mta-sts.txt. The body is CRLF-separated key/value text. Keep the keys lower-case as shown and include at least one mx: line.
version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400
Understand each field
version: STSv1is the current MTA-STS policy version.mode: testing,enforceornonecontrols sender behavior.mx:identifies permitted MX hostnames or patterns. Add one line for each permitted pattern, such asmx: *.mail.example.comwhen your deployment genuinely uses matching subdomains.max_age:is the number of seconds senders may cache the policy. The example uses 86,400 seconds, or one day; choose a period that gives you time to notice mistakes without leaving stale instructions cached for too long.
Do not put comments, HTML, JSON or a trailing redirect target in this file. A policy fetch should receive only the plain-text policy body.
Configure Apache to serve the well-known URL
Define a dedicated HTTPS virtual host
Create or edit the Apache virtual host for mta-sts.example.com. Adapt certificate paths, filesystem locations and access-control syntax to your VPS distribution.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
<VirtualHost *:443>
ServerName mta-sts.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/mta-sts.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mta-sts.example.com/privkey.pem
Alias /.well-known/mta-sts.txt /var/www/mta-sts/.well-known/mta-sts.txt
<Files /var/www/mta-sts/.well-known/mta-sts.txt>
ForceType text/plain
</Files>
<Directory /var/www/mta-sts/.well-known>
Require all granted
</Directory>
</VirtualHost>Alias maps the exact URL to the controlled file. ForceType text/plain ensures Apache sends the required media type even if another module would infer a different type. An equivalent AddType text/plain rule can be used when it is scoped carefully to this file. Do not enable directory listing or allow uploads in the policy directory.
Enable HTTPS and reload safely
- Place the virtual-host file in the location used by your distribution and enable the SSL module and site if they are not already active.
- Set ownership and permissions so Apache can read the file and ordinary users cannot modify it. A root-owned file with read permission for the Apache service account is a practical baseline.
- Run Apache’s configuration check, commonly
apachectl configtestorapache2ctl configtest. Fix every syntax error before reloading. - Reload Apache through the service manager, for example
systemctl reload apache2orsystemctl reload httpd. A reload avoids dropping existing connections on systems that support graceful reloads. - Confirm that the certificate-renewal process updates the certificate files referenced by the virtual host and performs a graceful reload after renewal.
Keep the well-known path on HTTPS with no HTTP-to-HTTPS hop at the fetch URL itself. MTA-STS senders must not follow HTTP 3xx redirects when retrieving the policy, so a redirect from the exact path is a configuration failure rather than a convenience.
Verify the endpoint from outside the VPS
Test from an external network, not only from localhost. The essential check is:
curl -i https://mta-sts.example.com/.well-known/mta-sts.txtThe response should contain an HTTP 200 status and a Content-Type: text/plain header, followed by the policy text. Check that there is no Location: header and that the response is not an HTML error page generated by a reverse proxy or access-control rule.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAlso inspect the TLS handshake and hostname. A browser may appear to work while an SMTP implementation rejects the certificate chain, an expired intermediate or a hostname mismatch. Verify that the certificate is currently valid for mta-sts.example.com, chains to a trusted public CA and is served by the virtual host selected through SNI.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Query DNS through more than one recursive resolver and verify both TXT records. Confirm that the _mta-sts record contains the expected id, that the TLSRPT record spells v=TLSRPTv1 correctly, and that your domain’s MX set agrees with the policy’s mx: lines.
Set up and interpret TLS reporting
What arrives in a report
RFC 8460 reports are JSON documents containing the reporting organization, a reporting time range, a report identifier, the policy type and result details. Policy types can include sts for MTA-STS, tlsa for DANE-related policy, or no-policy-found when the sender found no applicable policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Aggregate reports are not normally one message per delivery. They summarize observations over a period chosen by the reporting sender. Store the raw JSON as well as parsed fields so you can compare changes after a DNS, certificate or mail-server deployment.
Use reports during testing
- Leave the policy in
testingand wait through at least one normal reporting cycle from major sending partners. - Group failures by MX hostname, certificate name, certificate-chain error, STARTTLS availability and policy mismatch.
- Investigate legitimate senders that connect to an old MX, an alternate hostname or an IPv6 address with different TLS configuration.
- Correct the mail server, certificate, DNS or
mx:pattern, then continue observing until reports are clean across expected traffic.
A report proves that a sender observed a result; it does not prove that every sender reports or that a clean period covers every rare correspondent. Keep testing long enough to include low-volume business partners and backup mail routes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Move from testing to enforcement without locking out mail
Use a staged change
When testing has exposed no unresolved legitimate failures, edit the policy to:
version: STSv1
mode: enforce
mx: mail.example.com
max_age: 86400
At the same time, publish a new id in the _mta-sts TXT record, for example v=STSv1; id=2026101601. Senders can cache policies, and many will not notice an endpoint-only edit immediately. Updating both the record identifier and the HTTPS file gives implementations a reason to refetch while still respecting their cache behavior.
Understand the enforcement consequences
With mode: enforce, a sender must refuse delivery when the destination MX does not match an allowed pattern, STARTTLS is unavailable, or the certificate presented by the MX cannot be validated. Mail may be delayed and eventually generate a nondelivery report rather than being sent in cleartext or to an untrusted endpoint.
Before enforcement, verify every advertised MX, including disaster-recovery hosts, providers used for inbound filtering, and IPv6 endpoints. If an MX name is a CNAME or resolves to infrastructure managed by another party, confirm that the final SMTP host presents a certificate valid for the hostname the sender connects to and that the name is covered by the policy pattern.
Troubleshoot common failures
| Symptom | Likely cause | Correction |
|---|---|---|
| Policy fetch returns 301, 302 or another 3xx | HTTP-to-HTTPS rewrite, trailing-slash rule or proxy redirect | Serve the exact HTTPS path directly and exempt it from redirect rules. |
| HTTP 200 but wrong content type | Apache treats the file as HTML or applies a global MIME rule | Scope ForceType text/plain or AddType text/plain to the policy file. |
| HTTP 404 | Alias target is wrong, file is missing, or the virtual host is not the one selected by SNI |
Check the absolute filesystem path, permissions, enabled site and ServerName. |
| TLS handshake fails | Certificate does not include mta-sts.example.com, is expired, lacks an intermediate, or the wrong virtual host serves it |
Renew or replace the certificate, install the full chain and test with SNI from an external network. |
| Senders report MX mismatch | An active MX is absent from the policy or the wildcard pattern is too narrow | List every legitimate MX pattern, then republish the policy and increment the TXT id. |
| Reports never arrive | Malformed _smtp._tls record, inaccessible mailbox, filtering or an unsupported sender |
Query the TXT record exactly, verify mailbox delivery and inspect mail logs; remember that not every sender implements TLSRPT. |
| Mail breaks immediately after enforcement | A rare sender or backup route was not observed during testing, or a certificate expired | Return to testing or none temporarily, repair the route, increment id and repeat staged observation. |
| Changes appear ignored | DNS and policy caches still contain the previous identifier or body | Confirm authoritative DNS, allow cache periods to pass and avoid relying on an endpoint-only edit. |
Security and maintenance practices
- Keep the policy directory isolated from application uploads, writable web content and directory indexes.
- Monitor certificate expiration and renewal failures; MTA-STS depends on the policy host remaining reachable over trusted HTTPS even when SMTP is healthy.
- Alert on changes to the
_mta-stsand_smtp._tlsTXT records, unexpected policy-file edits and Apache configuration changes. - Retain TLSRPT data long enough to identify seasonal or infrequent senders, while applying your organization’s privacy and retention rules.
- When adding or removing an MX, deploy the mail-server TLS configuration and policy pattern together, then use
testingto observe the new route before enforcement. - Use a sensible
max_age. A very long value reduces DNS and HTTPS traffic but prolongs the effect of a mistaken policy; a short value allows faster correction but does not eliminate all sender caching.
Self-hosted Apache versus a hosted policy service
Apache on your VPS is appropriate when you control the filesystem, DNS, certificate lifecycle and report mailbox. It gives direct control over the policy contents and lets you stage changes without introducing another provider. The trade-off is that you must patch Apache, renew certificates, monitor availability and build or operate report aggregation.
A hosted MTA-STS and TLSRPT service can reduce web-server and report-processing maintenance, but it adds provider dependency. You still retain responsibility for DNS accuracy, MX coverage, certificate behavior on your mail servers and verifying that the provider actually serves the policy and processes reports as promised.
Recommended Free Tools
Quick Recap
| Decision factor | Apache on your VPS | Hosted endpoint or aggregator |
|---|---|---|
| Filesystem control | Maximum; you manage the exact file and access permissions | Depends on the provider’s dashboard or API |
| Certificate automation | Your renewal client and Apache reload must work continuously | Usually handled by the provider for its hostname, subject to its service design |
| DNS control | You still manage both TXT records | You still manage the records, sometimes pointing them at provider-specific names |
| Report aggregation and alerting | You must provide the mailbox, parser, storage and alerts | Often included, but verify retention, parsing and notification behavior |
| Testing before enforcement | Fully available by changing mode and observing your own reports |
Available only if the service supports policy staging and exposes the underlying data |
Final deployment checklist
- DNS:
_mta-stshasv=STSv1and a unique currentid;_smtp._tlshasv=TLSRPTv1and a workingruadestination. - HTTPS:
mta-sts.example.comresolves, its certificate covers the exact hostname, and the well-known URL returns 200 without a redirect. - Media type: the response is
text/plainand contains only valid policy text. - Policy: every receiving MX matches an
mx:pattern;version,modeandmax_ageare present and intentional. - Reports: the destination accepts JSON, retains it and alerts on failures.
- Rollout: testing observations cover normal and backup routes before changing to enforce, and the TXT
idchanges with every policy revision.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
