MTA-STS

MTA-STS is a policy that lets an email domain tell sending mail servers which receiving mail servers should accept TLS connections with verified server identities. TLS encrypts the connection between mail servers and checks the receiving server's certificate. MTA-STS can help prevent an attacker from silently reducing that connection's security or redirecting it, provided the sending system supports and applies the policy.

How does a sender find the policy?

The recipient domain publishes a TXT record at _mta-sts.example.com that signals whether a policy exists and whether it has changed. The sending mail server can then fetch a policy file over HTTPS from mta-sts.example.com/.well-known/mta-sts.txt. The policy lists acceptable MX host names, a mode such as testing or enforcement, and how long the sender may keep a saved copy of the policy.

For example, example.com publishes a policy listing mail.example.com as an allowed mail exchanger. A sender that has fetched and cached an enforcement policy can refuse or delay delivery if the MX server does not present a trusted certificate over TLS. The message may be retried later; enforcing a policy that is misconfigured can disrupt legitimate email delivery.

Does MTA-STS encrypt every email message?

No. It addresses the SMTP connection used to transfer email between sending and receiving mail servers, not necessarily every connection or the message while stored in mailboxes. The sender must support MTA-STS and have discovered the policy. MTA-STS also does not replace SPF, DKIM, or DMARC, which address checks on the sender's domain rather than the connection to the recipient's mail server.

Related terms

• Mail server — the SMTP servers covered by a policy
• TLS — protects the server-to-server connection
• MX record — names receiving mail servers
• TLS-RPT — reports mail TLS connection problems