MTA-STS on cPanel and DirectAdmin: Policy File and TLS-RPT

Short answer: Create the subdomain mta-sts.example.com in cPanel or DirectAdmin, make sure it has a valid TLS certificate, and put a plain-text file at /.well-known/mta-sts.txt in its document root containing version: STSv1, mode: testing, one mx: line per MX host and max_age. Then publish _mta-sts.example.com TXT "v=STSv1; id=..." and a TLS-RPT record at _smtp._tls.example.com. Before switching to mode: enforce, confirm every MX host presents a valid certificate for its own name.

Neither panel has a built-in MTA-STS feature: we found none in cPanel & WHM 11.138 or DirectAdmin 1.712 on our AlmaLinux 9.8 lab servers on 6 October 2026. On the same day we ran the SMTP certificate and MIME checks shown below on those servers. The policy format was checked against RFC 8461 and RFC 8460; we did not publish a live policy for a lab domain.

What you are setting up

MTA-STS lets a receiving domain tell sending servers: “only deliver to these MX hosts, and only over TLS with a valid certificate”. It has three parts:

Part	Where	Example
Policy indicator	TXT at _mta-sts.example.com	v=STSv1; id=202610060001
Policy file	https://mta-sts.example.com/.well-known/mta-sts.txt	mode, allowed MX names, cache time
TLS reporting (TLS-RPT)	TXT at _smtp._tls.example.com	v=TLSRPTv1; rua=mailto:tlsrpt@example.com

The id is 1 to 32 letters and digits. Senders cache your policy and only fetch it again when the id changes, so change it every time you edit the file.

Step 1: check your MX certificates first

In enforce mode, senders refuse to deliver if the MX host does not present a valid, unexpired certificate that matches the MX host name. Check each MX before anything else:

dig +short MX example.com
echo QUIT | openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com 2>/dev/null | openssl x509 -noout -subject -issuer -enddate -ext subjectAltName

What we saw on our labs is a good warning. On DirectAdmin, Exim chose the domain’s Let’s Encrypt certificate by SNI, and it listed mail., smtp. and pop. names for the domain. On cPanel, for a domain whose own certificate was self-signed, Exim fell back to the server hostname’s certificate, which does not cover mail. that domain. A policy listing mx: mail.example.com would fail there in enforce mode.

Two ways to get a valid match on shared hosting:

• Make sure AutoSSL (cPanel) or Let’s Encrypt (DirectAdmin) issues a certificate that covers mail.example.com, and confirm with the command above that Exim presents it.
• Or point the domain’s MX at the server hostname (for example server1.example.net), which always has a valid certificate, and list that name in the policy.

Our SMTP Test shows the certificate an MX presents, and our MX Lookup lists the MX names you must put in the policy.

Step 2: host the policy on cPanel

1. In cPanel, open Domains and create mta-sts.example.com. Note the document root cPanel assigns to it.
2. If the zone is hosted on the server, cPanel adds the DNS record for the new subdomain. If DNS is elsewhere (for example Cloudflare), add an A (and AAAA if used) record for mta-sts pointing to the server.
3. Run AutoSSL for the account, or wait for the next run, and check that mta-sts.example.com gets a valid certificate.
4. In File Manager, inside that document root, create the folder .well-known (enable “Show Hidden Files” to see it) and the file mta-sts.txt.

Step 2 (alternative): host the policy on DirectAdmin

1. In DirectAdmin, open Subdomain Management for example.com and add mta-sts. DirectAdmin creates a folder for the subdomain inside the domain’s web root; confirm the exact path in File Manager.
2. If DNS is local, DirectAdmin adds the record. Otherwise add an A record for mta-sts at your DNS provider.
3. In SSL Certificates, request or renew the Let’s Encrypt certificate so it includes mta-sts.example.com.
4. Create .well-known/mta-sts.txt inside the subdomain’s folder.

Step 3: write the policy file

Start in testing mode with a short cache time:

version: STSv1
mode: testing
mx: mail.example.com
mx: mail2.example.com
max_age: 86400

• mode: testing (report failures but deliver anyway), enforce (refuse delivery that fails), or none (used when removing MTA-STS).
• mx: one line per allowed MX name. A wildcard is allowed only as the whole left-most label: *.example.com matches mail.example.com but not example.com.
• max_age: seconds senders may cache the policy, maximum 31557600 (about one year). RFC 8461 expects weeks or more once you are confident; 604800 (one week) is a common next step.

Lines may end in LF or CRLF. Apache’s mime.types on both our labs maps .txt to text/plain, which is the media type RFC 8461 says senders should check.

Policies are fetched over HTTPS and only a 200 response counts: RFC 8461 says senders must not follow 3xx redirects. A redirect to www, to a “coming soon” page or to the main site breaks the policy.

If the subdomain’s folder sits inside the main site’s public_html (the usual DirectAdmin layout), Apache also reads the parent folder’s .htaccess, so WordPress or “force www” rewrite rules can apply to the policy URL. If your test below shows a redirect, add a .htaccess file in the subdomain’s folder containing RewriteEngine Off and test again.

Step 4: publish the DNS records

_mta-sts.example.com.   TXT  "v=STSv1; id=202610060001"
_smtp._tls.example.com. TXT  "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"

Use cPanel’s Zone Editor, DirectAdmin’s DNS Management, or your external DNS provider. The TLS-RPT address receives daily JSON reports from large senders about TLS successes and failures to your MX hosts. Use a mailbox that can take attachments, or a reporting service.

Check that it worked

curl -sS -i https://mta-sts.example.com/.well-known/mta-sts.txt
dig +short TXT _mta-sts.example.com
dig +short TXT _smtp._tls.example.com

• The curl output must start with HTTP/1.1 200 or HTTP/2 200, show content-type: text/plain, have no location: header, and print your policy.
• Our MTA-STS Checker fetches the TXT record and policy and checks the MX names against your real MX records.
• Our TLS-RPT Checker validates the _smtp._tls record.
• Wait a few days in testing mode and read the TLS-RPT reports. Zero failures for every MX means you can move on.

Switch to enforce, and change the policy safely

1. Edit mta-sts.txt: set mode: enforce and a longer max_age, such as 604800.
2. Update the id in the _mta-sts TXT record so senders refetch.
3. Before you change MX hosts later, add the new MX to the policy first, update the id, and wait at least the old max_age before removing the old MX. Senders with a cached policy will refuse an MX that is not in it.
4. To remove MTA-STS, publish mode: none with a new id and keep it online for the full previous max_age before deleting anything.

Common problems

• Certificate error on the policy host. AutoSSL or Let’s Encrypt has not covered mta-sts.example.com yet, usually because DNS for the subdomain was missing or pointed elsewhere when validation ran.
• 301 to https or www. Remove the redirect for the subdomain; senders fetch the https URL directly and will not follow it.
• Policy MX names do not match the real MX records. After a mail migration, the old policy still lists old hosts. Update the file and the id together.
• HTML instead of the policy. The request fell through to a CMS 404 page. Check the file is in the subdomain’s document root, not the main site’s.
• Cloudflare in front. Proxied subdomains work if Cloudflare serves a valid certificate and adds no redirect or challenge for the path. Bot challenges block policy fetches.

Official documentation: RFC 8461: SMTP MTA Strict Transport Security · RFC 8460: SMTP TLS Reporting · cPanel docs: Domains

Related: MTA-STS Checker · TLS-RPT Checker · SMTP Test: Free STARTTLS, Certificate and Banner Check · cPanel Hostname SSL: Let’s Encrypt AutoSSL Fix in WHM · DirectAdmin Old Certificate After Renewal: 3 Service Fixes

See also: MTA-STS Generator: TXT Record and Policy File · TLS-RPT Record Generator: _smtp._tls TXT Record

Frequently asked questions