Skip to content
Techno Trader

Security & DNS

MTA-STS

Published policy that requires inbound mail servers to use authenticated TLS, closing the downgrade path that plain opportunistic encryption leaves open.

Encrypted mail transport between two data centre cabinets with a lit padlock on the link
SYSTEM ACTIVE
ENFORCED TRANSPORT · MTA-STS

Capabilities

What we implement

  • Policy file hosting over HTTPS with a valid certificate
  • DNS policy record and versioning
  • Testing mode before enforce mode
  • MX and certificate name alignment review

Security

How it is hardened

  • Prevents cleartext downgrade and interception of inbound mail
  • Certificate expiry monitored so policy never breaks delivery
  • Policy changes versioned and logged

Architecture

MTA-STS policy delivery

A policy file served over HTTPS plus a DNS record tells sending servers that TLS is mandatory for your domain.

  1. 01 · Policy host

    mta-sts subdomainHTTPS with valid certificatePolicy file

    The policy is only trusted when it is fetched over a properly validated certificate.

  2. 02 · DNS

    _mta-sts TXT recordPolicy id versioningTTL control

    Version id changes whenever the policy file changes, so senders refresh.

  3. 03 · Modes

    testingenforcenone

    Testing collects reports without risking delivery; enforce is applied once clean.

  4. 04 · Assurance

    MX name matchCertificate expiry monitoringTLS-RPT reports

    Certificate expiry on the MX hosts becomes a delivery issue, so it is monitored.

FAQ

MTA-STS questions we are asked

Can MTA-STS break inbound mail?
Only if a certificate on an MX host expires or a name no longer matches the policy. Both are monitored, and testing mode is used first for exactly this reason.
Do we still need DANE?
DANE requires DNSSEC and is used where the provider supports it. MTA-STS is the practical option for most hosted mail platforms.
Who enforces the policy?
The sending server. MTA-STS is a statement to other mail servers about how they must connect to you.

Related

Other security & dns platforms

SPFDKIMDMARCTLS-RPTSSL CertificatesCloudflare DNSProtective DNS FilteringEmail Security Gateway

MTA-STS is referenced to describe engineering capability. All trademarks and product names are the property of their respective owners; no partnership or endorsement is implied.

Ready to scope the work?

Share your environment and objectives. You will get an engineering response covering scope, approach and considerations.

Request a QuoteWhatsApp
WhatsAppRequest Quote