3 ms·
Right, but now you're on the hook for setting up MTA-STS yourself, which as this post shows is no easy task.
by agwa 5y ago
Right, but now you're on the hook for setting up MTA-STS yourself, which as this post shows is no easy task.
- rovr138 5y agoIf you're using a provider, you're not on the hook for it. Unless I'm mistaken in how this is implemented (not just server side)
- agwa 5y agoYour provider is on the hook for properly configuring TLS on their mail server, but you still need to publish an MTA-STS policy saying who your provider is. Unless your provider provides MTA-STS endpoints that you can CNAME your _mta-sts and mta-sts subdomains to. I haven't seen anyone do this yet.
- Byteflux 5y agoFor sure. It's not trivial but I also wouldn't say it's difficult either, maybe more of a moderate difficulty? The policy file format is straight forward, as are the necessary TXT and CNAME records. In my case, I use Cloudflare for my domain so I set up a Cloudflare Pages project to generate and host the policy file at the mta-sts subdomain which is nice because I don't have to worry about hosting or SSL/TLS. As long as your provider supports MTA-STS, you're only on the hook for setting up the records and hosting the policy file.
- agwa 5y agoIf you never make changes, that will work once it's set up. But if you ever decide to change your mail provider, you'll have to remember to correctly update your MTA-STS policy. If your change to Cloudflare Pages doesn't propagate through the Cloudflare CDN right away, you could end up in the situation described in the blog post, with the TXT record updated before the text file, and other mail servers unable to send you email.