MTA-STS & TLS-RPT

Looking good

• Policy is in enforce modeSenders that honour MTA-STS will refuse to deliver over an unauthenticated connection.
• max_age is 604,800 secondsLong enough that blocking a policy refresh does not quickly remove protection.
• TLS-RPT reporting is configuredDaily summaries of TLS negotiation failures go to https://tlsrpt.azurewebsites.net/report.
• Every MX host is covered by the policyAll 1 MX records match an mx pattern in the policy file.

DNS record

_mta-sts.microsoft.com

v=STSv1; id=20190225000000Z;

Policy file

https://mta-sts.microsoft.com/.well-known/mta-sts.txt · 83 bytes

version: STSv1
mode: enforce
mx: *.mail.protection.outlook.com
max_age: 604800

MX coverage

Every host that accepts your mail has to match an mx: pattern in the policy. In enforce mode, one that doesn’t is mail that will not be delivered.

TLS-RPT record

_smtp._tls.microsoft.com

v=TLSRPTv1;rua=https://tlsrpt.azurewebsites.net/report

Also check this domain’s DMARC & SPF, DKIM keys or the certificates its mail servers present.