Policy File

SMTP MTA Strict Transport Security

MTA-STS policy
for xtom.com

This host publishes the MTA-STS policy for xtom.com, as defined in RFC 8461. Sending servers that support MTA-STS deliver mail for xtom.com only over TLS, only to the MX hosts listed in the policy, and only when the certificate is valid.

View the Policy Read RFC 8461
XTOM.COM · MTA-STS

DNS · TXT RECORD

$ dig +short TXT _mta-sts.xtom.com
"v=STSv1; id=2026110801"

HTTPS · POLICY FILE

$ curl https://mta-sts.xtom.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: *.mail.protection.outlook.com
max_age: 604800

MODE: ENFORCE

MAX AGE 604800 S · 7 DAYS

Standard
RFC 8461
Mode
Enforce
Max age
7 days
Mail host
Microsoft 365

Why MTA-STS

By default, TLS between mail servers is opportunistic. An attacker on the network path can remove the STARTTLS offer or present an invalid certificate, and most senders will then deliver in plain text. MTA-STS lets a receiving domain require TLS with certificate validation instead.

01 · Discover

The sender checks DNS

The sender queries the TXT record at _mta-sts.xtom.com. The id value changes with each policy update, which tells senders to fetch the policy again.

02 · Fetch

The sender fetches the policy

The sender downloads /.well-known/mta-sts.txt from this host over HTTPS. The policy is accepted only if this host presents a valid certificate.

03 · Enforce

The sender applies the policy

The sender delivers only to MX hosts that match the policy, over TLS with a valid certificate. Hosts that fail either check are not used.

Policy Fields

version STSv1

Policy format version. STSv1 is the only version defined in RFC 8461.

mode enforce

Senders must not deliver to an MX host that fails certificate validation or does not match the mx pattern. Other modes are testing, in which failures are reported but mail is still delivered, and none.

mx *.mail.protection.outlook.com

MX hosts permitted to receive mail for xtom.com. Inbound mail for xtom.com is handled by Microsoft 365 Exchange Online Protection.

max_age 604800

Time in seconds that senders may cache the policy: 7 days. Senders continue to apply a cached policy if this host cannot be reached.

To report a delivery problem to xtom.com, contact us with the sending server and the error message returned.