Guide

What is MTA-STS?

MTA-STS lets a domain declare that mail sent to it must use TLS, closing the downgrade attack that ordinary opportunistic encryption leaves open.

Why opportunistic TLS is not enough

By default, a sending server offers STARTTLS and encrypts if the receiver accepts. An attacker positioned between the two servers can simply strip that offer from the conversation, and the message is delivered in plain text. Neither side sees an error, and nobody is told.

MTA-STS publishes a policy saying "always use TLS to reach me, and here are my valid mail hosts". A sender that supports it will refuse to deliver rather than fall back.

The two halves

A TXT record at _mta-sts.example.com announces that a policy exists and carries an ID that changes when you update it. The policy itself is served over HTTPS at https://mta-sts.example.com/.well-known/mta-sts.txt, which is what makes it tamper-resistant — it is protected by the web certificate for that host.

Policies have three modes. testing reports failures without blocking, enforce refuses insecure delivery, and none withdraws the policy.

TLS reporting goes with it

A _smtp._tls TXT record asks sending servers to report failed TLS connections to you. Without it, a broken certificate on your mail server produces silent delivery failures that no one reports — you find out when someone mentions the mail they sent last week never arrived.

Example

The announcement record and a policy in testing mode

_mta-sts.example.com.  3600  IN  TXT  "v=STSv1; id=20260902T000000;"
_smtp._tls.example.com. 3600  IN  TXT  "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"

# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

Start in `testing`, and remember the certificate

Going straight to enforce with an incomplete mx: list stops mail reaching you, and the sender sees the failure rather than you. Run testing with TLS reporting for a few weeks first. Also note that the policy host, mta-sts.example.com, needs its own valid certificate — if that certificate lapses, senders cannot read the policy, and how they react depends on how long your max_age told them to remember the last one.

Check your mail transport security.