# Setting up hosted MTA-STS
Before setting up hosted MTA-STS, we recommend enabling [SMTP TLS reporting](/docs/tlsrpt/setup). Reports let you find transport security problems while your policy is still in `testing` mode.
- Only team members with permission to manage domains can enable hosted MTA-STS or validate its DNS records.
## Enabling hosted MTA-STS
From the dashboard:
- Choose the domain you want to configure.
- Open **Hosted services** → **MTA-STS**.
- Click Enable hosted MTA-STS.
DMARCwise reads the current MX records for the domain and creates the first policy with:
- Mode set to `testing`.
- Max age set to 14 days.
- The detected MX servers included automatically.
If the domain has no usable MX records, fix its DNS configuration before continuing.
## Creating the DNS records
The dashboard will show two `CNAME` records. Add both records at your DNS provider.
| Purpose | Type | Hostname | Value |
| --- | --- | --- | --- |
| Policy discovery | `CNAME` | `_mta-sts` | Copy from the dashboard |
| Policy host | `CNAME` | `mta-sts` | Copy from the dashboard |
Use a TTL of `3600` seconds when your DNS provider asks for one.
Some providers expect the full hostname, such as `_mta-sts.example.com`, while others only expect `_mta-sts`. Follow the convention used for your other DNS records.
If either hostname already has a `TXT`, `A`, `AAAA` or other record, remove the conflicting record before creating the `CNAME`. A CNAME cannot share a hostname with another record.
## Validating the records
After saving the DNS changes, return to DMARCwise and click Validate.
DNS changes can take some time to propagate. If a record is still shown as missing, wait a few minutes and try again.
Keep both CNAME records in place while using hosted MTA-STS. The discovery record lets DMARCwise announce policy changes, while the policy host record makes the policy available at the address required by the MTA-STS standard.
## Certificate provisioning
Once the policy host CNAME is valid, DMARCwise starts provisioning the TLS certificate for `mta-sts.{your domain}`. The dashboard will show **Certificate pending** while this is in progress.
No action is normally required. DMARCwise will activate the hosted policy automatically and renew the certificate when needed. If certificate issuance continues to require attention, [contact support](/@/support).
The setup is complete when the dashboard reports that DNS and the certificate are healthy.
DMARCwise uses **Let's Encrypt** to issue the certificate and publishes the required CAA authorization on the target of the policy host CNAME.
You don't need to add or change the CAA records on your domain for hosted MTA-STS and this does not affect certificate issuance for your other hostnames.
## Moving from testing to enforce
The initial policy does not block delivery when a sender encounters an MTA-STS validation problem. Leave the policy in `testing` mode while you review the [SMTP TLS reports](/docs/tlsrpt/setup) received for the domain.
When you are confident that all legitimate MX servers support TLS with valid certificates, change the policy to `enforce`. See [Managing MTA-STS policies](/docs/mta-sts/managing-policies) for details.