Mail Transfer Agent Strict Transport Security is a standard (RFC 8461) that lets a receiving domain publish a policy: deliver to these MX hosts, over TLS 1.2 or later, with a certificate that matches. A DNS TXT record at _mta-sts advertises the policy, and an HTTPS file at mta-sts. /.well-known/mta-sts.txt carries it. Supporting senders validate both before they hand over a message.

Do I need to run a web server or renew a certificate?

No. That is the part Folio removes. Folio hosts the policy file and the certificate for mta-sts. , keeps the policy id current, and ingests the TLS reports. You publish three DNS records once and keep them in place.

What are the three records?

A CNAME at mta-sts routes the policy host to Folio; a TXT at _smtp._tls names the TLS-report mailbox; a CNAME at _mta-sts delegates discovery to a policy Folio controls. Your DNS provider may append the zone automatically, so the panel copies only the relative name.

What is the difference between testing and enforce?

In testing, senders that support MTA-STS still deliver when a TLS check fails, but they mail a report. In enforce, a supporting sender refuses the untrusted connection and retries or bounces. Every domain starts in testing for 14 days; enforcement waits for a clean policy host, MX and report window. Mail is never blocked by testing mode.

Does it protect mail I send?

No. MTA-STS is a receiver-side policy for inbound mail. Outbound identity is SPF, DKIM and DMARC; Folio generates a per-domain DKIM key and publishes the sending records for you. The two layers are complementary, not substitutes.

Will it work with Google Workspace, Microsoft 365 or Zoho senders?

Yes, when those sending systems support MTA-STS. A sender that does not support it can still connect without the guarantee. That is why MTA-STS is published alongside TLS-RPT rather than treated as a blanket guarantee.

Is Inbound TLS included in my plan?

Yes. It is an optional, included capability for eligible verified domains that receive mail through Folio. There is no separate add-on and no per-domain certificate bill.

What happens if I leave Folio?

Folio publishes a non-enforcing policy and gives you a cleanup date before the records can be removed. Senders may keep a cached policy until it expires. Your DNS records stay yours, and the same three records can be moved to another policy host.

Start free

Inbound transport · MTA-STS, hosted

Inbound TLS protection, without the web server.

MTA-STS asks sending servers to deliver to your domain only over a verified TLS connection. Most providers make you run the policy file and renew its certificate for every domain. Folio hosts all of it. You publish three DNS records once.

You publish: Three DNS records, once
Folio hosts: The policy file and its certificate
Starts in: Testing for 14 days — reports, not blocks
Covers: Every verified domain that receives mail here

Connect a domain Check a domain first

I · The gap

Opportunistic TLS is a request, not a promise.

SMTP has no built-in encryption. STARTTLS adds it opportunistically: a sending server asks whether the receiver supports TLS, and if the answer is stripped or the certificate does not validate, the default is to fall back quietly to cleartext. The sender may never tell you.

MTA-STS closes that downgrade path. The domain publishes a policy over HTTPS — a channel an on-path attacker cannot forge — naming the MX hosts that may receive its mail and the TLS version they must offer. A sender that supports MTA-STS validates the policy, the MX name and the certificate before it hands over the message.

It protects the hop between servers. It does not encrypt the mailbox, authenticate the sender, or replace SPF, DKIM and DMARC.

II · The work

Three records. One certificate. Zero servers.

A policy host normally means a public HTTPS endpoint, a certificate for mta-sts.<domain>, a policy version to bump, and a mailbox for TLS reports — for every domain. Folio runs that layer for you. This is the whole customer-side setup.

Folio · Inbound TLS protection

yourdomain.com

Waiting for DNS

01
CNAMERoutes the policy host to Folio, so senders can fetch the policy over HTTPS.
Host
mta-sts
Value
k0d36b1ff4c93a47a9c9c.mta-sts-host.wm.emcognito.com
02
TXTTells senders where to mail daily TLS reports. Folio reads them for you.
Host
_smtp._tls
Value
v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.com
03
CNAMELets Folio publish and update the policy id. Activated last, after the policy is live.
Host
_mta-sts
Value
k0d36b1ff4c93a47a9c9c._mta-sts-policy.wm.emcognito.com

Reproduction of the in-app record list. Hosts are shown relative to your domain, as your DNS provider expects.

Folio handles

The policy file at mta-sts.<domain>/.well-known/mta-sts.txt
The HTTPS certificate and its renewal
The policy id and version changes
Daily TLS-RPT reports, parsed per domain
The testing window and the enforcement gate

You handle

Three DNS records, once. Keep them in place while the policy is active. If you leave, Folio gives you a cleanup date before they can be removed.

Included for eligible verified domains. Optional — your mail keeps arriving whether or not you turn it on.

III · The sequence

Set it once. Watch the evidence.

01
Add a domain that receives mail here
Inbound TLS applies to a verified domain whose MX points at Folio. If the domain is send-only, the panel explains what has to change first.
02
Publish three records
Copy the relative host names your DNS provider expects. Most providers append the zone; Folio shows the full hostname beside the part that gets copied.
03
Let the testing window run
Every domain starts in testing for 14 days. Senders that support MTA-STS report failures, but mail is not blocked. Folio checks the records every 15 minutes.
04
Enforce when the checks pass
Enforcement is gated on a clean policy host, MX and report window. It is not a switch you flip on day one, and mail keeps arriving while the evidence accumulates.

Free tool Check a domain's MTA-STS and TLS-RPT records → The dashboard See TLS reports across every domain → Field note The do-it-yourself MTA-STS guide →

IV · The boundaries

What it does — and what it does not.

Not outbound authentication

MTA-STS protects the hop into your domain. SPF, DKIM and DMARC prove who may send as you.

Outbound authentication →

Not end-to-end encryption

It protects server-to-server transport. Mail is still stored on Folio's servers so spam filtering and search can read it.

How mail is stored →

Not every sender

Only senders that support MTA-STS get the guarantee. A sender without it can still fall back to an unencrypted connection.

Deliverability reports →

Not anti-spoofing

An MTA-STS policy cannot stop a forged From line. Folio's inbound checks file unverifiable senders before they reach you.

Anti-spoofing →

The portfolio tax

A policy per domain is the point — and the tax.

Every domain needs its own policy host, certificate, version and report stream. One domain is an afternoon; six domains is six endpoints to renew and six places to notice an expiry before a sender refuses your mail. Folio keeps the per-domain guarantee and removes the per-domain web server. Each domain still gets its own policy, certificate and report view — they just share one operator.

Plainly asked

Questions, answered.

What is MTA-STS?: Mail Transfer Agent Strict Transport Security is a standard (RFC 8461) that lets a receiving domain publish a policy: deliver to these MX hosts, over TLS 1.2 or later, with a certificate that matches. A DNS TXT record at _mta-sts advertises the policy, and an HTTPS file at mta-sts.<domain>/.well-known/mta-sts.txt carries it. Supporting senders validate both before they hand over a message.
Do I need to run a web server or renew a certificate?: No. That is the part Folio removes. Folio hosts the policy file and the certificate for mta-sts.<domain>, keeps the policy id current, and ingests the TLS reports. You publish three DNS records once and keep them in place.
What are the three records?: A CNAME at mta-sts routes the policy host to Folio; a TXT at _smtp._tls names the TLS-report mailbox; a CNAME at _mta-sts delegates discovery to a policy Folio controls. Your DNS provider may append the zone automatically, so the panel copies only the relative name.
What is the difference between testing and enforce?: In testing, senders that support MTA-STS still deliver when a TLS check fails, but they mail a report. In enforce, a supporting sender refuses the untrusted connection and retries or bounces. Every domain starts in testing for 14 days; enforcement waits for a clean policy host, MX and report window. Mail is never blocked by testing mode.
Does it protect mail I send?: No. MTA-STS is a receiver-side policy for inbound mail. Outbound identity is SPF, DKIM and DMARC; Folio generates a per-domain DKIM key and publishes the sending records for you. The two layers are complementary, not substitutes.
Will it work with Google Workspace, Microsoft 365 or Zoho senders?: Yes, when those sending systems support MTA-STS. A sender that does not support it can still connect without the guarantee. That is why MTA-STS is published alongside TLS-RPT rather than treated as a blanket guarantee.
Is Inbound TLS included in my plan?: Yes. It is an optional, included capability for eligible verified domains that receive mail through Folio. There is no separate add-on and no per-domain certificate bill.
What happens if I leave Folio?: Folio publishes a non-enforcing policy and gives you a cleanup date before the records can be removed. Senders may keep a cached policy until it expires. Your DNS records stay yours, and the same three records can be moved to another policy host.

Stop running a policy server for every domain.

Connect a domain and publish three records once. Testing starts immediately; enforcement waits until the evidence is clean.

Connect a domain Run the audit first

Sources