Opportunistic TLS can be downgraded by an attacker in the network path. MTA-STS closes that hole and is increasingly a checkbox in security questionnaires.
The metrics that matter#
- Authentication pass rate: share of mail passing SPF, DKIM, and DMARC alignment. Healthy: 99% or higher.
- Spam complaint rate: Gmail enforces at 0.3%; stay under 0.1%.
- Hard bounce rate: under 2%; above 5% triggers platform reviews.
- Inbox placement: above 90% across major providers via seed tests.
- Engagement: click and reply rates by segment; opens are unreliable after Mail Privacy Protection.
Where to read them#
- Google Postmaster Tools for Gmail domain reputation, spam rate, and authentication.
- Microsoft SNDS and JMRP for Outlook.com IP reputation and complaints.
- Your ESP's delivery and bounce reports.
- DMARC aggregate reports for authentication by source.
Improving the numbers#
- Publish a _mta-sts TXT record with an id value you will change on each policy update.
- Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing your MX hosts.
- Start in mode: testing, then move to mode: enforce after reviewing TLS-RPT reports.
- Publish _smtp._tls TXT with rua=mailto: to receive TLS-RPT reports.
version: STSv1
mode: enforce
mx: aspmx.l.google.com
mx: *.googlemail.com
max_age: 604800Frequently asked questions#
Does MTA-STS affect outbound mail?
Only when the recipient domain publishes a policy. Your own policy protects mail coming to you.
Is DANE better than MTA-STS?
DANE requires DNSSEC and is stronger, but MTA-STS is easier to adopt. Microsoft and Google both support MTA-STS.