MTA-STS Explained
What MTA-STS Does for Email Delivery
MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that lets a domain require encrypted, verified delivery of email sent to it. Without it, a sending server may quietly fall back to plain text when the TLS upgrade fails, so the protection is only as strong as the weakest connection on the route.
The idea is borrowed from HTTP Strict Transport Security, which tells browsers to use HTTPS only for a site. MTA-STS applies the same idea to the mail servers that receive a domain's email. General background on encryption methods is in email encryption.
How the Policy Is Published and Enforced
A domain publishes its policy in two places. A DNS TXT record announces that a policy exists and carries an identifier, so senders know when to fetch an updated copy. The policy itself is a text file served over HTTPS from a fixed address on the domain. It lists the mail servers allowed to receive mail for the domain, the mode, and a maximum age that tells senders how long they may keep the policy.
A sending server that supports MTA-STS fetches the policy and delivers only to a listed mail server that presents a valid TLS certificate matching its name. Modes control strictness. testing reports failures without blocking delivery, enforce refuses delivery when the checks fail, and none switches the policy off.
Reporting TLS Failures with TLS-RPT
TLS-RPT (TLS Reporting) is a companion standard. A domain publishes a DNS record that tells sending servers where to send aggregated reports about TLS problems, such as expired certificates or failed upgrades. These reports help the domain owner find issues before moving from testing to enforce mode, since enforcing a broken setup can block legitimate mail.
Frequently asked questions
What happens if a sending server does not support MTA-STS?
It falls back to its usual behavior, which is typically opportunistic TLS or, if that fails, plain text. MTA-STS therefore protects only mail from senders that check the policy. It strengthens delivery to a domain, but it is not a guarantee that every message will be encrypted.
Is MTA-STS the same as DMARC?
No. DMARC tells receivers what to do with messages that fail authentication for a sending domain. MTA-STS controls whether mail delivered to a domain must travel over verified TLS. They solve different problems and are often used together.