Make Sure Mail to You Is Actually Encrypted
SMTP encryption is opportunistic. A sending server sees STARTTLS advertised and upgrades the connection, unless someone on the path strips that line out, or answers with a certificate for the wrong host. Then the mail is delivered in plain text, and nobody is told.
MTA-STS (RFC 8461) closes that gap. Your domain publishes a policy that says “only deliver to these MX hosts, over TLS with a valid certificate”, and senders such as Gmail and Outlook enforce it. Setting it up yourself means hosting an HTTPS site, keeping a certificate valid, and updating a DNS record every time the policy changes. Seabhac.io does all of that for you.
How it works
- Add two CNAME records once:
mta-sts.yourdomainand_mta-sts.yourdomainpoint at us. The control panel shows the exact values, and checks what those names resolve to today before you start. - We host and maintain the policy: We serve the policy file over HTTPS with its own certificate, and publish a new policy id in DNS whenever the policy changes, so senders always pick up the latest version.
- Every MX host is checked like a sender would: Every 6 hours we fetch your policy, then connect to each MX host with STARTTLS and require a certificate valid for its name. You are alerted if something would make senders refuse mail.
Safe by Default
- Starts in testing mode. Senders report TLS problems to you but never refuse mail, so turning it on cannot break delivery.
- Policy built from your live MX records. The MX patterns come from your DNS, and the check warns if an MX host is ever missing from the policy.
- Clear DNS diagnostics. If a wildcard record, an old A record or a leftover self-hosted TXT record is answering instead of our CNAME, the control panel tells you exactly which one.
- Safe removal. Disabling publishes
mode: noneand keeps serving it until senders’ cached copies expire, as RFC 8461 requires, instead of leaving a stale policy behind.
Alerts That Matter
Each hosted policy gets a monitor with three alert rules ready to go:
- MTA-STS check failing: the record, the policy file or an MX host would cause problems for a sender in enforce mode.
- MX host not covered by the policy: you added or changed an MX host, and the policy does not include it yet.
- Certificate expiring: the policy host or an MX host certificate has less than 14 days left.
TLS Reports in the Same Place
Point your _smtp._tls record at us and the TLS-RPT reports that Gmail, Microsoft and others send back arrive alongside your DMARC data. You see how many sessions to your domain succeeded over TLS, and exactly which failures senders hit.
Switching a policy to enforce mode, with a gate based on your check results and TLS reports, is coming next.
Already Running MTA-STS Yourself?
The MTA-STS check also works for self-hosted policies on every plan: add an MTA-STS Policy monitor for your domain and get the same per-MX STARTTLS and certificate checks and alerts. Hosted MTA-STS is included in the Pro plan and above. See the MTA-STS documentation for setup details.