MTA-STS, TLS-RPT and BIMI: The Next Steps After DMARC

Advanced⏱ 4 min readUpdated October 13, 2026

SPF, DKIM and DMARC prove who sent a message. They say nothing about whether it travelled encrypted, and nothing about how it looks in the inbox. Three newer standards fill those gaps: MTA-STS makes other servers deliver to you only over verified TLS, TLS-RPT tells you when that fails, and BIMI puts your logo next to authenticated mail. Each is a TXT record plus one other piece.

MTA-STS: encrypted delivery, or none

Mail servers encrypt with STARTTLS when both sides support it, but they fall back to plain text if the offer is missing — and an attacker on the path can remove it. MTA-STS (RFC 8461) publishes a promise: "my MX hosts always have valid certificates; do not deliver without TLS". It takes a DNS record and a small text file on a web server:

; announces the policy; change id whenever the policy file changes
_mta-sts.example.com.  3600 IN TXT   "v=STSv1; id=20261013T1200"
; the web host that serves the policy file over HTTPS
mta-sts.example.com.   3600 IN CNAME static-host.example.
# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 604800
  • mode: testing reports failures but still delivers; enforce refuses to deliver without valid TLS; none withdraws the policy.
  • mx: one line per MX host, exactly as in your MX records. A leading *. matches one label, for providers with many hosts.
  • max_age: how long senders cache the policy, in seconds. One week (604800) while you test; several months once it is stable.
  1. Get a valid certificate for mta-sts.example.com and serve the file at /.well-known/mta-sts.txt — any static host works.
  2. Publish _mta-sts with a new id (a timestamp is convenient).
  3. Add the TLS-RPT record from the next section and run in testing for two to four weeks.
  4. When the reports are clean, change mode to enforce and update the id.
Watch out: Senders cache the policy for max_age. If you change MX hosts under an enforce policy without updating the file and the id first, servers that cached it will refuse to deliver to the new hosts. Update the policy before the MX records, not after.

TLS-RPT: reports on failed encryption

TLS-RPT (RFC 8460) asks sending servers to send you a daily summary of their TLS connections to your mail servers: how many succeeded, and why the others failed — expired certificate, name mismatch, STARTTLS missing, policy fetch error.

_smtp._tls.example.com. 3600 IN TXT "v=TLSRPTv1; rua=mailto:[email protected]"

Google, Microsoft and other large providers send these reports as JSON files. On its own the record changes nothing about delivery, so it is safe to publish first. With MTA-STS in testing, it is how you find out whether enforce would break anything.

BIMI: your logo in the inbox

BIMI (Brand Indicators for Message Identification) lets supporting mailboxes show your logo instead of an initial next to messages that pass DMARC. The record points to the logo and, usually, to a certificate that proves you may use it:

default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"
  • DMARC must be enforced: p=quarantine or p=reject on the domain, without a pct below 100 and without sp=none.
  • The logo is a square SVG in the restricted "SVG Tiny Portable/Secure" profile, served over HTTPS. An ordinary SVG export is usually rejected.
  • Gmail shows the logo only with a certificate: a VMC (Verified Mark Certificate), which requires a registered trademark, or a CMC (Common Mark Certificate), which requires the logo to have been in use for at least a year. Yahoo may show it without one.
Note: Certificates are issued by a few certificate authorities and cost a few hundred to over a thousand dollars a year. BIMI is a branding feature — it does not improve deliverability by itself, and DMARC enforcement brings the security benefit with or without it.

In what order

  1. SPF, DKIM and DMARC with p=none and reports (see How to set up DMARC).
  2. TLS-RPT — free, harmless and informative from day one.
  3. MTA-STS in testing, then enforce once the TLS reports are clean.
  4. DMARC moved to p=quarantine and then p=reject.
  5. BIMI, if a logo in the inbox is worth the certificate to you.
Tip: If your domain is signed with DNSSEC and your mail provider supports it, DANE (TLSA records, RFC 7672) gives the same protection as MTA-STS without a web server, and many European providers check it. The two can run side by side.
Check your domain's email security →Next: how to set up DMARC →

Frequently asked questions

Do I need MTA-STS if I use Google Workspace or Microsoft 365?

They encrypt by default, but MTA-STS is what stops a sender from falling back to plain text when an attacker strips STARTTLS. You publish it for your domain; the provider's certificates already meet the requirement.

Why does my MTA-STS policy not apply?

Most often the policy file is not reachable over HTTPS with a valid certificate for mta-sts.<your domain>, the mx lines do not match the MX records, or the id was not changed after an edit.

Is TLS-RPT useful without MTA-STS?

Yes. It shows TLS failures on connections to your mail servers whether or not you publish a policy, and it is the safe first step.

Can I use BIMI without a VMC?

The record works without a certificate, but Gmail will not show the logo. A CMC is the cheaper alternative when you have no registered trademark.

Try it on your domain

See the theory in practice — run a Email Security Check for your own domain.

Updated October 13, 2026

Sources
Related articles
How to Set Up DMARC → Gmail and Yahoo sender requirements → CAA Records →