iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To deploy MTA-STS on an Apache VPS, publish an _mta-sts DNS record, serve a valid policy at https://mta-sts.example.com/.well-known/mta-sts.txt, and publish a separate _smtp._tls record for TLS reports. Start with mode: testing, verify reports and delivery, then change the policy to enforce with a new policy ID. The HTTPS endpoint must use a certificate valid for the exact policy hostname, return HTTP 200 without a redirect, and send text/plain.
What MTA-STS and TLS-RPT do
Mail Transfer Agent Strict Transport Security (MTA-STS), defined by RFC 8461 (IETF, 2018), lets a receiving domain tell sending mail servers which MX hosts are authorized and what to do when encrypted SMTP cannot be negotiated or the certificate cannot be trusted. Without an enforcement policy, a sender may fall back to unauthenticated SMTP when TLS fails.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11SMTP TLS Reporting (TLS-RPT), defined by RFC 8460 (IETF, 2018), is a separate reporting mechanism. It does not enforce encryption. It advertises a JSON-report destination so senders can describe TLS successes, certificate errors, policy mismatches, and other connection failures.
The two mechanisms work together:
- MTA-STS publishes the desired delivery behavior.
- TLS-RPT shows whether senders encountered problems applying that behavior.
- Testing mode provides visibility before delivery is blocked.
RFC 8461 requires implementations to support TLS 1.2 or TLS 1.3 (or a later version). MTA-STS policy retrieval itself happens over HTTPS, so the policy hostname needs ordinary web PKI, independent of the certificates used by your SMTP MX hosts.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Architecture and required DNS names
For a domain named example.com, the deployment has four distinct pieces:
- A TXT record at
_mta-sts.example.comthat enables discovery and carries a policy ID. - An HTTPS virtual host named
mta-sts.example.com. - The policy file at
/.well-known/mta-sts.txton that host. - A TXT record at
_smtp._tls.example.comthat advertises a TLS-RPT destination.
Sending MTAs discover the DNS record first, then fetch the HTTPS policy. They should require HTTP 200, validate the certificate for mta-sts.example.com, accept a text/plain response, and not follow HTTP 3xx redirects for the policy fetch.
The MTA-STS discovery record
Create this TXT record in the authoritative DNS zone for example.com:
_mta-sts.example.com. TXT "v=STSv1; id=2026101501"v=STSv1 identifies the current MTA-STS version. The id is an opaque policy version identifier. Change it whenever you publish a different policy so senders have a reason to refetch a policy they may have cached. The identifier is not the same as max_age in the policy file.
The TLS-RPT discovery record
Publish a separate TXT record:
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"The rua value identifies one or more aggregate report destinations. Use a mailbox or an aggregation endpoint that can accept the JSON reports generated by senders. Do not assume that an ordinary mailbox automatically parses, stores, or alerts on those reports; verify that your receiving workflow can handle them.
Prepare the Apache VPS
Prerequisites
- Administrative access to an Apache HTTP server on a publicly reachable VPS.
- DNS control for the policy domain.
- The hostname
mta-sts.example.comresolving to the VPS (or to the reverse proxy that serves Apache). - A publicly trusted certificate whose subject alternative name (SAN) covers
mta-sts.example.com. - Permission to create a controlled policy file and edit the HTTPS virtual-host configuration.
- A TLS-RPT mailbox or aggregation service capable of receiving JSON reports.
The MTA-STS endpoint does not need to be the same server as your MX hosts. It only needs stable HTTPS availability and a certificate valid for the policy hostname.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Choose a dedicated virtual host
Use a dedicated Apache HTTPS virtual host for mta-sts.example.com. This avoids accidental content negotiation, authentication, or application routing inherited from a general-purpose website. Keep the well-known path publicly readable and do not place it behind a login, cookie requirement, or IP allow-list.
Create the policy file
Store the file outside the web document root if practical, then expose only the required path through an Apache alias. For example:
/var/www/mta-sts/.well-known/mta-sts.txtUse CRLF-separated key/value lines. A safe initial policy is:
version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400
Policy fields
| Field | Purpose | Required handling |
|---|---|---|
version |
Identifies the policy format. | Use STSv1. |
mode |
Controls sender behavior. | Use testing, enforce, or none. |
mx |
Lists permitted MX host patterns. | Include one or more patterns matching every legitimate receiving MX. |
max_age |
States how long a sender may cache the policy. | Use a value appropriate to your change process; the example uses 86400 seconds. |
Write MX patterns carefully
List the hostnames that actually receive mail for the protected domain. If your DNS MX records point to several hosts, add an mx: line for each required pattern. A pattern that fails to match an actual MX can cause an enforcing sender to refuse delivery. Conversely, do not add unrelated hosts merely because they belong to the same organization.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesReview wildcard patterns and subdomain coverage against the MTA-STS rules implemented by your senders. The policy applies to the domain for which it was discovered; publishing a policy for example.com does not automatically publish one for every unrelated domain you operate.
Configure Apache to serve mta-sts.txt
Add an HTTPS virtual host similar to the following. Adapt certificate paths, filesystem locations, and permissions to your distribution:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
<VirtualHost *:443>
ServerName mta-sts.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/mta-sts.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mta-sts.example.com/privkey.pem
Alias "/.well-known/mta-sts.txt" "/var/www/mta-sts/.well-known/mta-sts.txt"
<Files "/var/www/mta-sts/.well-known/mta-sts.txt">
ForceType text/plain
</Files>
<Directory "/var/www/mta-sts/.well-known">
Require all granted
</Directory>
</VirtualHost>The Alias maps the exact URL to the exact file. ForceType text/plain prevents Apache from returning an HTML-oriented or otherwise incorrect media type. An equivalent AddType text/plain rule can be used when it is scoped so that it affects this file safely.
Certificate and redirect requirements
The certificate presented during the HTTPS fetch must validate for mta-sts.example.com and chain to a trusted public CA. A certificate valid only for example.com or for another web host is insufficient unless its SAN also includes the MTA-STS hostname.
Serve the well-known path directly on HTTPS. Do not rely on an HTTP-to-HTTPS redirect for this URL, and do not redirect from the MTA-STS hostname to a canonical website. Senders must not follow HTTP 3xx responses for policy retrieval, so a redirect can make an otherwise correct policy unusable.
Enable and reload Apache
- Place the virtual-host configuration in the location used by your VPS distribution.
- Enable the SSL, alias, and MIME functionality required by that configuration.
- Check the configuration with your distribution’s Apache syntax-test command.
- Reload Apache only after the syntax check succeeds.
- Confirm that the file is readable by the Apache process while its parent directories remain appropriately protected.
Certificate renewal must preserve the SAN for mta-sts.example.com. If renewal changes the virtual host, test the endpoint again after the reload.
Verify the endpoint from outside the VPS
Run these checks from an external network, not only from localhost:
curl -i https://mta-sts.example.com/.well-known/mta-sts.txtThe response should show:
- Status
HTTP/1.1 200orHTTP/2 200. Content-Type: text/plain(a charset parameter is generally acceptable alongside the media type).- The expected policy lines, including
version: STSv1, the intended mode, and every requiredmx:line. - No 301 or 302 response and no HTML error page.
Inspect DNS independently:
dig +short TXT _mta-sts.example.com
dig +short TXT _smtp._tls.example.comInspect the certificate and negotiated protocol:
openssl s_client -connect mta-sts.example.com:443 -servername mta-sts.example.comCheck the certificate’s SAN, issuer, validity dates, and chain in the output. The TLS connection should negotiate TLS 1.2 or TLS 1.3 (or a later supported version).
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Move from testing to enforce safely
What testing mode does
With mode: testing, senders that support TLS-RPT can report policy failures while delivery may continue. Use this period to discover stale MX records, missing certificates, STARTTLS failures, DNS mistakes, and hosts that do not match the policy.
Review reports over a representative operating period that includes normal traffic, secondary MX usage, and maintenance windows. A single successful fetch of the policy proves only that the endpoint works; it does not prove that every sender can establish trusted TLS to every listed MX.
Correct failures before enforcement
- Update the
mx:lines when a legitimate receiving host is missing. - Install a publicly trusted certificate on each MX named by the policy.
- Ensure each MX offers STARTTLS and supports TLS 1.2 or later.
- Correct certificate names, incomplete chains, expiration, and clock-related validation errors.
- Remove obsolete MX records or hosts that should no longer receive mail.
- Confirm that the TLS-RPT destination is accepting and retaining JSON reports.
Publish an enforcing policy
After failures are understood and corrected, change only the policy mode first:
version: STSv1
mode: enforce
mx: mail.example.com
max_age: 86400
Publish the updated file, then change the id in the _mta-sts TXT record, for example:
_mta-sts.example.com. TXT "v=STSv1; id=2026101502"Update both locations because senders can cache policies. Changing the endpoint without changing the DNS ID may leave some senders using the cached version; changing the ID without serving the new file can produce an inconsistent deployment.
Understand enforcement consequences
In enforce mode, a sender must not deliver to an MX when the MX does not match a permitted pattern, STARTTLS is unavailable, or the presented certificate fails validation. This protects against downgrade and interception scenarios but can also defer legitimate mail when an MX is misconfigured. Keep an operational rollback plan: restore a corrected testing policy, or use mode: none when you need to withdraw MTA-STS behavior while diagnosing a serious issue, and publish a new policy ID for that change.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
How TLS-RPT reports help operations
Reports use JSON and identify the reporting organization, reporting time range, report ID, policy type, applied policy, and result details. Policy types include tlsa, sts, and no-policy-found. Use the data to distinguish an MTA-STS policy failure from a general TLS problem or a sender that did not find a policy.
Recommended Free Tools
Provide the rua destination to the team responsible for mail reliability. Decide how reports will be deduplicated, retained, and escalated before enforcement. Aggregation and alerting are operational choices separate from Apache; the DNS record only tells senders where to send reports.
Self-hosted Apache versus a hosted endpoint
A VPS is not the only deployment model. Compare the operational trade-offs before committing:
| Consideration | Apache on your VPS | Hosted MTA-STS/TLS-RPT service |
|---|---|---|
| Filesystem control | Direct control over the policy file, Apache mapping, and access permissions. | Provider controls storage and publishing; verify how policy changes are approved. |
| Certificate automation | You maintain issuance, renewal, and Apache reloads for the policy hostname. | The provider may handle certificates, but confirm renewal and hostname coverage. |
| DNS control | You publish and update both TXT records yourself. | You still control DNS, although the provider supplies record values. |
| Report aggregation and alerting | You must operate the mailbox or aggregation and build monitoring. | Aggregation and alerting may be included; verify JSON support, retention, and access. |
| Testing before enforcement | Full control over testing, report review, and the mode transition. | Usually available, but confirm staged-mode behavior and policy-ID handling. |
| Dependency | Depends on your VPS, Apache, DNS, and certificate operations. | Reduces server maintenance but adds dependency on the provider’s availability and implementation. |
Choose self-hosting when you already operate Apache and need direct change control. Choose a hosted endpoint only after verifying that it can serve the exact path with the required status and media type, preserve your policy IDs, and deliver usable TLS-RPT data.
Troubleshooting common failures
DNS record is not discovered
- Confirm the name is exactly
_mta-sts.example.com; do not place it at the apex. - Check that the TXT value contains
v=STSv1and anid. - Query an authoritative or external resolver to rule out local caching.
- For TLS reporting, verify the separate name
_smtp._tls.example.comand thev=TLSRPTv1value.
Policy fetch returns 404, 403, or HTML
- Check the spelling and case of
/.well-known/mta-sts.txt. - Verify that the
Aliastarget exists and that Apache can traverse its parent directories. - Ensure the
Require all grantedrule applies to the aliased directory. - Look for a broader virtual-host or application rule intercepting the path.
- Use
curl -ito confirm the body is the policy, not an error document.
Wrong status or redirect
Inspect both port 80 and port 443 rules, reverse-proxy settings, and canonical-host redirects. The final HTTPS request to the exact well-known URL must return 200 directly. Remove path-specific redirects rather than expecting senders to follow them.
Wrong content type
Use ForceType text/plain inside the scoped file rule, or a narrowly scoped AddType text/plain. Re-test the response headers after every Apache reload. A browser rendering readable text does not prove that the media type is correct.
Certificate validation fails
Check the SAN for mta-sts.example.com, the complete chain, expiration, and the certificate selected through SNI. The openssl s_client command with -servername helps reveal a default certificate being served by mistake.
Mail is deferred after enforcement
Use TLS-RPT details to identify the failing MX and result. Compare the reported MX with the policy’s mx: patterns, test STARTTLS on that host, and validate its certificate from an external system. Correct the MX or certificate, then publish the change with a new MTA-STS ID. If delivery risk is immediate, withdraw enforcement with a newly identified policy rather than silently editing the endpoint and waiting for caches to expire.
Quick Recap
Deployment checklist
- DNS points
mta-sts.example.comto the Apache service. - The certificate SAN includes the exact policy hostname and chains to a trusted CA.
_mta-sts.example.compublishesv=STSv1and a unique currentid.- The policy contains
version: STSv1, an intentional mode, and every requiredmx:pattern. - Apache serves the exact well-known URL with HTTP 200 and
text/plain, without redirects. _smtp._tls.example.compublishesv=TLSRPTv1and a workingruadestination.- External tests confirm DNS, certificate, TLS protocol, status, headers, and file contents.
- Testing-mode reports have been reviewed and failures corrected.
- Every policy change updates both the HTTPS file and the DNS
id. - Enforcement rollback and certificate-renewal procedures are documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
