MTA-STS policy

What it means

The policy is a few key: value lines. version: STSv1; mode: enforce, testing or none; one mx: line per allowed MX host, where a leading *. matches one label (mx: *.example.net); and max_age, the number of seconds senders may cache it, up to 31557600 (about one year).

It must be served over HTTPS from the mta-sts subdomain with a certificate valid for that name, as plain text, without redirects. If the host cannot be reached, senders that already hold a valid cached policy keep applying it.

When you add or rename MX hosts, update the mx lines and change the id in the TXT record before the new hosts receive mail, or enforcing senders will refuse to deliver to them.