Definition
MTA-STS (Mail Transfer Agent Strict Transport Security) tells receiving servers to require TLS for inbound mail, preventing downgrade attacks on transport.
It is published via DNS and a policy file served over HTTPS, and should be adopted gradually.
MTA-STS hardens transport against downgrade attacks by requiring TLS for inbound mail. Rolling out in testing mode first catches issues before blocking legitimate senders. Monitoring reports guides the transition to enforce.
Rolling Out MTA-STS
Publish the MTA-STS policy file over HTTPS.
Start in testing mode with a valid TLS report address.
Why It Matters
MTA-STS hardens transport against downgrade attacks. Understanding it improves the security of your mail infrastructure.
Best Practices
- Publish the MTA-STS policy file over HTTPS.
- Start in testing mode with a valid TLS report address.
- Monitor reports and upgrade to enforce gradually.
- Keep certificates valid.
- Test before switching to enforce.
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
DKIM Alignment
DKIM alignment is the DMARC requirement that the domain in the From header matches the domain in the DKIM signature, confirming the visible sender domain is authenticated.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
Frequently Asked Questions
A standard to require TLS for receiving mail connections. MTA-STS hardens transport against downgrade attacks by requiring TLS for inbound mail.
A JSON policy served over HTTPS that receivers fetch. Rolling out in testing mode first catches issues before blocking legitimate senders.
Senders refuse insecure transport to the domain. Monitoring reports guides the transition to enforce.
To catch issues before blocking legitimate senders. MTA-STS hardens transport against downgrade attacks by requiring TLS for inbound mail.
It is a receiving-side policy. Rolling out in testing mode first catches issues before blocking legitimate senders.