What is MTA-STS?
MTA-STS (RFC 8461) is a DNS record plus an HTTPS policy file that tells senders to deliver your mail only over verified TLS, which blocks downgrade attacks.
MTA-STS enforces TLS encryption for inbound email. Defined in RFC 8461 as Mail Transfer Agent Strict Transport Security, it lets domain owners publish a policy that instructs sending mail servers to require authenticated, encrypted TLS connections when delivering email to that domain.
Without MTA-STS, SMTP uses opportunistic TLS — meaning it will attempt a TLS connection but fall back to plaintext if TLS negotiation fails. This makes email vulnerable to downgrade attacks where a network attacker forces plaintext delivery to intercept or tamper with messages.
What problem does MTA-STS solve?
Standard SMTP has no mechanism to require TLS. An attacker intercepting the connection can strip the STARTTLS advertisement and force plaintext delivery — the sender cannot distinguish a legitimate TLS failure from an active attack. MTA-STS publishes the TLS requirement out-of-band via DNS and HTTPS, two channels an attacker would need to compromise simultaneously. A sender that retrieves and caches your policy will refuse plaintext delivery even if STARTTLS is stripped.
How does MTA-STS work?
MTA-STS requires two components: a DNS TXT record and an HTTPS-hosted policy file.
Step 1 — DNS TXT record: Publish a record at _mta-sts.yourdomain.com signaling that a policy exists:
_mta-sts.example.com. IN TXT "v=STSv1; id=20260101000000Z"v=STSv1— version tag (required).id=— a policy identifier that changes whenever your policy changes, allowing senders to detect updates. Typically a timestamp in the formatYYYYMMDDHHmmssZ.
Step 2 — HTTPS policy file: Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with a valid TLS certificate:
version: STSv1
mode: enforce
mx: mail.example.com
mx: *.example.com
max_age: 604800version:Must beSTSv1.mode:The enforcement mode (see below).mx:One or more MX hostname patterns that are authorized to receive mail for your domain. Wildcards are supported.max_age:How long (in seconds) senders should cache this policy. 604800 = 7 days.
What are the MTA-STS policy modes?
The mode: line in the policy file sets what a sending server does when it cannot deliver over valid TLS to one of your listed MX hosts:
| Mode | When TLS fails, the sender | Use it when |
|---|---|---|
testing | Delivers anyway and reports the failure through TLS-RPT | You first publish a policy, to find certificate and MX problems safely |
enforce | Does not deliver, and reports the failure through TLS-RPT | TLS-RPT reports show every legitimate connection succeeding |
none | Stops applying any policy it cached for your domain | You are retiring MTA-STS for the domain |
Who enforces MTA-STS?
MTA-STS protects mail sent to your domain, so what matters is which senders check it. Two of the largest do:
- Gmail has honored MTA-STS and TLS-RPT policies when sending since April 2019.
- Microsoft 365 (Exchange Online) validates MTA-STS on all outbound mail to domains that publish a policy, with no admin setup.
The UK National Cyber Security Centre recommends MTA-STS, starting in testing mode with TLS-RPT set up so you get feedback before you enforce.
How does MTA-STS relate to TLS-RPT?
MTA-STS and TLS-RPT are complementary. MTA-STS enforces TLS; TLS-RPT reports when enforcement causes delivery failures. Recommended sequence: deploy TLS-RPT first, add MTA-STS in testing mode, resolve any certificate or MX hostname issues shown in reports, then switch to enforce mode.
MTA-STS hosting with DDMARC
Hosting the policy file requires a subdomain with a valid TLS certificate serving /.well-known/mta-sts.txt over HTTPS. Managed hosting for this file is included from the Growth plan — configure your policy in the dashboard and add a CNAME pointing mta-sts.yourdomain.com to DDMARC's servers. You only need to add the DNS TXT record yourself.
Frequently asked questions
Does MTA-STS affect outbound email from my domain?
No. MTA-STS only applies to inbound email delivery — it tells external sending servers how to connect when delivering mail to your domain. To protect your outbound email, ensure your sending infrastructure supports STARTTLS and consider deploying DMARC, DKIM, and SPF for authentication. Check your domain's full email security posture including MTA-STS status.
What happens if my TLS certificate expires while MTA-STS is in enforce mode?
Senders enforcing MTA-STS will fail to verify your TLS certificate and will not deliver email to the affected MX hostname. This can cause significant mail flow disruption. TLS-RPT reports will show a spike in certificate-expired failures. Renewing your certificate restores delivery — senders that have cached the policy will retry and succeed once the certificate is valid again.
How does MTA-STS differ from DANE?
Both MTA-STS and DANE (DNS-Based Authentication of Named Entities) enforce TLS for SMTP delivery, but through different mechanisms. DANE uses DNSSEC-signed TLSA records to pin certificate expectations directly in DNS — it requires DNSSEC deployment on both sides. MTA-STS uses a separate HTTPS-hosted policy file and does not require DNSSEC. MTA-STS has broader adoption today because DNSSEC deployment remains limited among sending MTAs.
Sources
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)
- RFC 8460: SMTP TLS Reporting
- UK NCSC: Using MTA-STS to protect the privacy of your emails
See what your own domain is publishing.
Everything in this article is externally observable. The free checker reads your records and tells you which of them are missing, weak, or already doing their job.