What are the policy modes (enforce, testing, none)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
MTA-STS has three policy modes, and they're meant to be a progression. You don't jump straight to the strictest mode. You ease into it.
The "testing" mode is where you start. Your policy says "I'm interested in TLS encryption, but I'm not going to break anyone's email over it." Mail still gets delivered whether encryption works or not. But here's the key part: when encryption fails, mail servers send you detailed reports (via TLS-RPT) about what went wrong. You're gathering data without enforcement. This is your chance to discover which sending partners are having trouble with TLS, which certificates are expiring, which servers don't support encryption yet. You monitor these reports for days or weeks, depending on your sending volume.
Then there's "enforce" mode. This is the strict requirement. Your policy now says "Encryption is mandatory." If a sending server can't establish TLS, the email bounces. Delivery fails rather than succeeding with plaintext. It's a hard requirement, and that's the point. You're preventing downgrade attacks by removing the fallback option.
The last mode is "none." You've published the MTA-STS framework for your domain, but you're not enforcing anything. This is useful if you previously had enforce mode, found problems, and need to step back without dismantling your entire policy structure. It's a graceful way to pause enforcement without deleting the DNS record and policy file.
Here's the real-world progression. If you've already got STARTTLS working reliably and your mail infrastructure is stable, you could test for a week or two before enforcing. But if you're not sure whether all your sending partners support TLS, test for at least a month. Watch the failure reports. Talk to your email provider. Then move to enforce once you're confident.
The most common mistake? Jumping straight to enforce without testing. Your bounce rate spikes, customer email goes missing, and nobody knows why. Start with testing. Always test first.
Check your current mode with our MTA-STS Checker and see what reports (if any) you'd get in testing mode.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
