MTA-STS policies are cached by sending mail servers. An enforcing policy can therefore remain active even after you change DNS records or stop serving the policy.
Hosted MTA-STS uses a retirement process to remove the service without leaving senders with a (potentially enforcing) cached policy that can no longer be refreshed.
Starting retirement
To disable hosted MTA-STS:
- Choose the domain in the dashboard.
- Open Hosted services → MTA-STS.
- Click Disable hosted MTA-STS.
- Confirm that you want to start retirement.
DMARCwise immediately publishes a new policy with mode: none and a max age of one day. The discovery record is updated so sending servers can fetch this non-enforcing policy.
The policy host and discovery record remain available during the retirement window. This gives previously cached policies time to expire.
Keep both MTA-STS CNAME records in place until the dashboard shows hosted MTA-STS as Disabled. Removing them during retirement may affect email delivery.
How long retirement takes
The dashboard shows the date when retirement is expected to finish.
The retirement period can last several weeks, to allow every previously published policy to expire. Changing the current policy to a shorter max age does not shorten the lifetime of copies that senders already cached.
When the retirement window ends, DMARCwise removes its hosted discovery record and stops serving the policy. The dashboard then shows the service as Disabled. At taht point, you can remove the two CNAME records from your DNS.
Re-enabling during retirement
Click Re-enable before retirement finishes if you want to keep using hosted MTA-STS.
DMARCwise cancels retirement, reads the domain’s current MX records and publishes a new policy. The reactivated policy starts with:
- Mode set to
testing. - Max age set to 14 days.
- The current detected MX servers.
- No additional MX servers.
Earlier revisions remain visible in the policy history for your reference.
Subscription cancellation
Hosted MTA-STS requires an active subscription. A few days after a subscription is canceled we schedule the MTA-STS retirement process. You will receive a warning email about this.
If the subscription is reactivated before retirement starts, hosted MTA-STS continues without interruption. After retirement has started, reactivating the subscription does not restore the policies automatically and you’ll have to re-enable hosted MTA-STS manually for each affected domain.
Domain deletion
Before deleting a domain with hosted MTA-STS enabled, we recommend disabling it and waiting for retirement to finish. This lets you follow its status and completion date from the dashboard.
If you delete the domain while hosted MTA-STS is still enabled, DMARCwise starts retirement automatically and continues serving the retiring policy, as long as the MTA-STS CNAME records are kept in place.