To ensure seamless email deliverability, it's crucial to follow the correct procedure when disabling MTA-STS for a domain.
Here's a step-by-step guide:
Set MTA-STS Mode to 'None': Begin by adjusting the MTA-STS mode to 'none'.
This can be done in the reporting portal, edit your DNS record and set your mode to testing.
Update the DNS Assertion Record: Modify the TXT record located at
_mta-sts.yourdomain.tld
to notify senders of the policy alteration. Essentially you need to update and increment the TXT record and increase the number or version of the policy. This help inform receivers that your record has updated and they should refer back to the record rather than relying on the cached version.
Maintain MTA-STS Policy Service: Ensure that the MTA-STS policy service remains active for the duration specified in themax_age
parameter of your MTA-STS policy. This is typically a 2-week period.
Remove DNS Entries for MTA-STS: After themax_age
cooldown period has elapsed, you can safely delete the DNS entries for MTA-STS, which includemta-sts.yourdomain.tld
and_mta-sts.yourdomain.tld
.
Caution: Avoid removing the DNS records prematurely. Doing so without adhering to the above steps could jeopardize email delivery to your domain.
Additional Tip: While it might seem appealing to decrease the max_age
value, it won't expedite the cooldown period. This is because senders might have cached the original max_age
value.