Phase 12: Configure MTA-STS and TLS reporting

MTA-STS tells other mail servers that your SMTP service should use encrypted transport and identifies the valid MX hostname.

12.1 DNS and Dokploy route

Add:

mta-sts CNAME mail.example.com.

Create a Dokploy domain:

mta-sts.example.com

Route it to:

Service: stalwart-mail
Container port: 8080
HTTPS: Enabled

12.2 MTA-STS DNS record

Add the ID generated by Stalwart:

Type: TXT
Name: _mta-sts
Value: v=STSv1; id=GENERATED_ID

12.3 TLS reporting

Add:

Type: TXT
Name: _smtp._tls
Value: v=TLSRPTv1; rua=mailto:postmaster@example.com

12.4 Verify the policy

Run:

curl -i https://mta-sts.example.com/.well-known/mta-sts.txt

Expected:

HTTP/2 200

version: STSv1
mode: testing
max_age: 604800
mx: mail.example.com

Keep the policy in testing mode until the server has been operating reliably.