Update 2025-09 MTA-STS Configuration

Cisco30

Hi
Before the 2025-09 update, I had configured Mailcow to use MTA-STS in this way:
mailcow.conf:

MAILCOW_HOSTNAME=mail.tiboxs.com
...
ADDITIONAL_SAN=mail.boubou.me,mail.climspeed.com,mta-sts.*,autoconfig.*,autodiscover.*
...
AUTODISCOVER_SAN=y
...
ADDITIONAL_SERVER_NAMES=mail.boubou.me,mail.climspeed.com,mta-sts.*

Then I created a file named “mta-sts.txt” in:
/opt/mailcow-dockerized/data/web/.well-known

version: STSv1
mode: enforce
max_age: 604800
mx: mail.tiboxs.com
mx: *.tiboxs.com

This file was accessible before the update from any domain, example:
https://mta-sts.tiboxs.com/.well-known/mta-sts.txt

But since the update this page is nowhere to be found.
Is there a way to configure MTA-STS specifically after this update?
Thanks

DocFraggle

Did you read the release notes?

mailcow/mailcow-dockerizedreleases/tag/2025-09

Cisco30

Yes, I read it. I just found the part that explains how to configure it with MTA-STS integrated into Mailcow. I deleted my manual configuration and recreated new certificates and it works. However, with Mailcow, I had a configuration where I could integrate mx: *.tiboxs.com. In the Mailcow admin interface, in the mta-sts section, you cannot add an mx server starting with *
I don’t know if it’s important or not that I can’t add my mx:
*.tiboxs.com
If you click on the link to my .txt file in the message and compare it to my old .txt file you will see that is the only difference.
mailcow/mailcow-dockerized6686

In any case it works after testing, I think I don’t have to worry more than that

Nipsa

Hi
Ive updated to the latest version.
Setting up MTA-STS for the first time.
I have multiple domains on my mailserver.
Servername mx1.domain1.com
A Record for mx1.domain1.com

Setting up STS for domain1.com
Added DNS TXT _mts-sts “v=STSv1; id=175752822844Z;”
Added DNS CNAME mta-sts to mx1.domain1.com

Enabled STS for domain1.com
Upon testing the DNS works however the https://mta-sts.domain1.com/.well-known/mta-sts.txt is never served.

When i hit it on https://mx1.domain1.com/.well-known/mta-sts.txt i still dont get the file returned but i do see a 404 hit on the nginx container

But when i hit https://mta-sts.domain1.com/.well-known/mta-sts.txt i dont even see a hit on nginx logs.

I have enabled ADDITIONAL_SERVER_NAMES=mta-sts.domain1.com in mailcow.conf.

About to give up lol.

Thanks for any help.

johan

Nipsa
I have exactly the same issue. My DNS works fine, the mta-sts and cname, mta_sts -> mail.creaski.eu, records are found. However upon testing, mailcow does not server a mta-sts.txt policy file. It seems the instrcutions on mailcow mta-sts doc does not cover the (nginx) rproyx server or the certificate adaptations in the san name. (My certificate is generated ousite mailcow).

I had a look to this post on the forum and I think I need to setup nginx to pass mail.creaski.be to mailcow. https port details for mailcow I couldn’t found yet.
HTTPS_PORT=8443 or HTTP_PORT=8080 seems a good candidate.

mlcwuser

johan My certificate is generated ousite mailcow).

Then I would say that you need to generate a certificate for the mta-sts subdomain on your reverse proxy and proxy the traffic to the IP address and port on which the mta-sta.txt file is served on your Mailcow server, which I guess would be: <IP-ADDRESS>:<PORT>/well-known/mta-sts.txt.

The mta-sts.txt file needs to be served at exactley this URL:

https://mta-sts.yourdomian.com/.well-known/mta-sts.txt

Or if that doesn’t work, maybe don’t use the mta-sts functionality in Mailcow, and serve it directly from your reverse proxy. At the end of the day it’s just a text file that needs to be seved. The important thing is that it’s served for each email domain that you’re hosting on your Mailcow server at exactly that URL shown above.

DocFraggle

Of course it doesn’t cover reverse proxy configurations, why would it? Everyone who sets up a reverse proxy in front of mailcow is on his own and of course has to adapt to new functions by himself.

I guess you have to forward mta-sts.your.domain as well now

accolon

DocFraggle

DocFraggle Of course it doesn’t cover reverse proxy configurations, why would it? Everyone who sets up a reverse proxy in front of mailcow is on his own and of course has to adapt to new functions by himself.

Mailcow has official documentation for running it with different reverse proxies: https://docs.mailcow.email/post_installation/reverse-proxy/r_p/

This just needs to be updated.