Deploy an MTA-STS policy to enforce TLS for inbound SMTP

Steps

1. Publish a DNS TXT record at _mta-sts.yourdomain.com with the content v=STSv1; id=YYYYMMDDTHHMMSS (use a timestamp string as the id); a TTL of 3600 is recommended.
2. Create an MTA-STS policy file in plaintext and serve it over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt; the policy file must be accessible without redirects.
3. Set the policy file content: version: STSv1 on the first line, mode: on the second (testing for observation, enforce to require TLS), max_age: set in seconds (for example 86400 for one day during testing or 604800 for production), and one or more mx: lines listing your accepted MX hostnames.
4. Start with mode: testing so sending servers log TLS failures without rejecting mail, then switch to mode: enforce once you confirm all inbound paths successfully negotiate TLS.
5. Update the id= value in the DNS TXT record every time you change the policy file; sending servers cache the policy for max_age seconds and re-fetch only when they see a new id value.
6. Pair MTA-STS with a TLS-RPT record (see separate route) to receive reports about TLS negotiation failures from sending servers.