# MTA-STS + TLS-RPT (pronto, da attivare quando il DNS esiste)

## 1) Record da aggiungere su register.it (zona xupus.com)
- A     mta-sts                     -> 62.84.186.255
- TXT   _mta-sts.mail               -> "v=STSv1; id=2026111301"
- TXT   _smtp._tls.mail             -> "v=TLSRPTv1; rua=mailto:postmaster@mail.xupus.com"

## 2) Blocco Caddy da aggiungere a /etc/caddy/Caddyfile (poi systemctl reload caddy)
mta-sts.mail.xupus.com {
	root * /opt/mail/sts
	header Content-Type text/plain
	file_server
}

## 3) Verifica
curl -s https://mta-sts.mail.xupus.com/.well-known/mta-sts.txt
(il file deve stare in /opt/mail/sts/.well-known/mta-sts.txt)

Quando e verificato, cambiare "mode: testing" -> "mode: enforce".