-# v=spf1 ip4:212.110.172.32 ip6:2001:41c9:1:400::32 mx include:_spf.google.com -all
-'openstreetmap:v=spf1\040ip4\072212.110.172.32\040ip6\0722001\07241c9\0721\072400\072\07232\040mx\040include\072_spf.google.com\040-all:86400
-'otrs.openstreetmap:v=spf1\040ip4\072212.110.172.32\040ip6\0722001\07241c9\0721\072400\072\07232\040mx\040include\072_spf.google.com\040-all:86400
+# v=spf1 ip4:212.110.172.32 ip6:2001:41c9:1:400::32 mx -all
+'openstreetmap:v=spf1\040ip4\072212.110.172.32\040ip6\0722001\07241c9\0721\072400\072\07232\040mx\040-all:86400
+'otrs.openstreetmap:v=spf1\040ip4\072212.110.172.32\040ip6\0722001\07241c9\0721\072400\072\07232\040mx\040-all:86400
+
+# Announce MTA-STS policy and TLSRPT policy for error reports
+
+'_mta-sts.openstreetmap:v=STSv1;\040id=202001291805Z
+'_smtp._tls.openstreetmap:v=TLSRPTv1;\040rua=mailto\072postmaster@openstreetmap.org
+
+# Delegate MTA-STS policy for subdomains
+
+C_mta-sts.noreply.openstreetmap:_mta-sts.openstreetmap
+C_mta-sts.otrs.openstreetmap:_mta-sts.openstreetmap
+C_mta-sts.messages.openstreetmap:_mta-sts.openstreetmap