MTA-STS mode
The mode line of an MTA-STS policy: enforce refuses delivery that fails validation, testing only reports failures, and none withdraws the policy.
What it means
enforce: sending servers must not deliver to an MX host that is not listed, does not offer STARTTLS, or presents a certificate that fails validation. They should treat the failure as temporary and check for an updated policy before giving up.
testing: senders deliver as if no policy existed, and those implementing TLS-RPT report what would have failed. It is the safe way to start, combined with a TLS-RPT record to collect the reports.
none: senders treat the domain as having no policy. RFC 8461 uses it to retire MTA-STS cleanly: publish mode none with a short max_age, wait for old caches to expire, then remove the records.
Example
mode: testingRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS), section 5rfc-editor.org
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS), section 8.3rfc-editor.org
- Microsoft Learn: Enhancing mail flow with MTA-STSlearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes