MTA-STS (SMTP MTA Strict Transport Security) is a standard defined in RFC 8461 that lets domain owners declare a policy requiring incoming mail servers to use TLS encryption when delivering email, and to refuse delivery if a secure connection cannot be established.
It works through two required components:
- DNS TXT record published at
_mta-sts.<domain>signalling the policy version. Example:_mta-sts.example.com. IN TXT "v=STSv1; id=20230101T000000" - HTTPS policy file served at
https://mta-sts.<domain>/.well-known/mta-sts.txtcontaining the actual policy rules.
Unlike SPF, DKIM, and DMARC, MTA-STS uses HTTPS instead of DNS because HTTPS is resistant to Man-in-the-Middle attacks—the threat MTA-STS protects against. An attacker can otherwise intercept SMTP negotiation and force fallback to unencrypted plaintext by blocking the TLS handshake.
Example policy file at https://mta-sts.example.com/.well-known/mta-sts.txt:
version: STSv1
mode: enforce
max_age: 604800
mx: mail.example.com
mx: backup-mail.example.com
The policy mode determines enforcement:
- testing: Reports failures but allows fallback; no delivery failure
- enforce: Requires TLS; fails delivery if encryption unavailable
- none: Policy disabled
WarningAlways roll out in testing mode first. Jumping directly to enforce mode with a misconfigured policy or high
max_age(cache duration) risks email delivery outages that persist across sender caches for weeks or months.
MTA-STS works alongside TLS-RPT (RFC 8460), which provides detailed failure reporting to detect attacks and configuration problems.