What MTA-STS is#
MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain declare that inbound mail must be delivered over TLS with a valid certificate. TLS-RPT provides reports on delivery failures caused by TLS problems.
Why it matters#
Opportunistic TLS can be downgraded by an attacker in the network path. MTA-STS closes that hole and is increasingly a checkbox in security questionnaires.
How mailbox providers use it#
Gmail, Microsoft, and Yahoo combine authentication results, sender reputation, and recipient engagement into a placement decision made per message. MTA-STS feeds directly into that model, and weaknesses compound with other signals.
How to measure the impact#
- Baseline inbox placement with seed tests before any change.
- Make one change at a time and hold volume steady.
- Re-test after 48 to 72 hours; provider models need time to update.
- Track Postmaster Tools and SNDS alongside your seed results.
Improving it#
- Publish a _mta-sts TXT record with an id value you will change on each policy update.
- Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing your MX hosts.
- Start in mode: testing, then move to mode: enforce after reviewing TLS-RPT reports.
- Publish _smtp._tls TXT with rua=mailto: to receive TLS-RPT reports.
version: STSv1
mode: enforce
mx: aspmx.l.google.com
mx: *.googlemail.com
max_age: 604800Frequently asked questions#
Does MTA-STS affect outbound mail?
Only when the recipient domain publishes a policy. Your own policy protects mail coming to you.
Is DANE better than MTA-STS?
DANE requires DNSSEC and is stronger, but MTA-STS is easier to adopt. Microsoft and Google both support MTA-STS.