Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

MTA-STS

SMTP MTA Strict Transport Security: a policy published over HTTPS and announced in DNS that tells sending servers to require TLS and to accept only named mail exchangers for a domain. Defined in RFC 8461.

Sumit Raj · reviewed

SMTP MTA Strict Transport Security. A way for a domain to state that mail arriving at it must be delivered over TLS, to servers it names.

It has two parts. A TXT record at _mta-sts.<domain> announces that a policy exists and carries an id that changes when the policy does. The policy itself is fetched over HTTPS from https://mta-sts.<domain>/.well-known/mta-sts.txt and lists the permitted mail exchangers and a mode.

The attack it prevents is stripping: an attacker in the network path removing the STARTTLS offer so mail is delivered in the clear. Without a policy, a sending server will usually fall back to an unencrypted connection rather than fail.

mode: testing reports problems and changes nothing. mode: enforce makes senders refuse delivery when the policy is not met. RFC 8461 section 3.3 forbids redirects on the policy fetch, which is a common misconfiguration when the policy is served by a general web host.

Related

  • TLS-RPTSMTP TLS Reporting: a DNS record asking sending servers to send daily reports about failures to establish a secure connection to a domain's mail servers. Defined in RFC 8460.
  • DANEDNS-Based Authentication of Named Entities: a TLSA record in DNSSEC-signed DNS that states which certificate a mail server must present, removing reliance on public certificate authorities. Defined in RFC 6698 and RFC 7672 for SMTP.
  • DNSSECDomain Name System Security Extensions: cryptographic signatures on DNS records that let a validating resolver confirm an answer came from the real zone and was not altered. Defined in RFC 4033 through RFC 4035.
  • MTA-STS TestFetches the policy the way a sender does, HTTPS, no redirects, and checks it against your MX.
  • MTA-STS GeneratorBuild the DNS record and the policy file it points at, with a fresh id.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.