TLS hardening and MTA-STS

TLS profile (UI → Configuration → Configuration → TLS):

• Set minimum to TLSv1.2. Disable TLSv1.0/1.1.
• Cipher suites: pick Intermediate (Mozilla SSL Config Generator profile). Modern breaks too many older relays.

MTA-STS (RFC 8461): advertises that your domain requires TLS for inbound mail. Two pieces:

1. DNS TXT at _mta-sts.example.com:

v=STSv1; id=20260101;

Bump id= whenever you change the policy.

2. Policy file at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800

TLS-RPT complements MTA-STS — DNS TXT at _smtp._tls.example.com pointing at a reporting mailbox. You'll get JSON reports when remote senders fail TLS to you.

Start mode: testing for two weeks, then switch to enforce once TLS-RPT shows zero failures.