MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) is an email security standard that lets a domain declare that inbound mail must be delivered only over an encrypted TLS connection. It addresses a weakness of classic SMTP, in which encryption is opportunistic and vulnerable to being forcibly downgraded to plaintext transmission.

How MTA-STS works

The domain owner publishes a security policy available over HTTPS plus a DNS record that signals it. Before sending a message, the sending server checks that policy and enforces its requirements. The mechanism consists of:

• A DNS TXT record — under the name _mta-sts, it announces the existence of a policy and its version (an identifier), signalling to sending servers that the domain supports MTA-STS.
• A policy file — served over HTTPS at mta-sts.domain, it lists the required MX servers, the enforcement mode and a validity period.
• Operating modes — testing (report without blocking), enforce (refuse delivery without valid TLS) and none (disabled).
• Policy caching — the sending server keeps the fetched policy for its declared validity period, so changing the identifier in the TXT record forces a refresh.

MTA-STS in practice

MTA-STS is deployed as part of hardening corporate email security:

1. Protection against downgrade attacks — it prevents an attacker from forcing mail to be sent unencrypted.
2. Preventing MX spoofing — the policy specifies which servers may receive the domain's mail.
3. Complementing DMARC and reporting — it works alongside DMARC, and together with TLS-RPT provides reports on encryption problems.

Correctly deploying MTA-STS requires control over the domain's DNS records and hosting able to serve a dedicated subdomain with an HTTPS certificate for the policy file.