Glossary
EMAIL AUTH

MTA-STS

Mail Transfer Agent Strict Transport Security — forces inbound SMTP over TLS with certificate validation, published via HTTPS.

MTA-STS (RFC 8461) tells sending mail servers that inbound SMTP for your domain requires TLS with a valid certificate. It closes the “opportunistic TLS” downgrade attack that STARTTLS alone allows.

How It’s Published

Two pieces:

  1. A DNS TXT record at _mta-sts.example.com declaring the policy exists:

    _mta-sts.example.com.  TXT  "v=STSv1; id=20260901T000000;"

  2. A policy file served over HTTPS at https://mta-sts.example.com/.well-known/mta-sts.txt:

    version: STSv1
mode: enforce
mx: *.mail.example.com
max_age: 604800

Modes

  • testing — report failures but still deliver
  • enforce — refuse delivery on TLS or MX mismatch
  • none — retracting the policy

Why It Matters

Without MTA-STS, an attacker on-path between the sender and your MX can strip STARTTLS, force plaintext SMTP, and read/tamper with mail. MTA-STS makes the sender fail closed instead of silently downgrading.

Check the TLS-RPT glossary entry, read what DMARC is, and see what an SSL certificate is.

← All terms Learning hub →