MTA-STS (SMTP MTA Strict Transport Security)

MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain publish a policy saying that servers sending it mail must use TLS and must verify the receiving server's certificate and hostname. Without it, SMTP encryption is opportunistic and can be stripped by an attacker.

Why it matters

Server-to-server STARTTLS falls back to plain text when the upgrade fails, so an attacker on the path can force a downgrade or redirect mail. MTA-STS closes that gap. It has two parts: a DNS TXT record announcing a policy version, and a policy file served over HTTPS from a fixed address. It is conceptually similar to HSTS for the web. Pairing it with TLS-RPT gives visibility into failures.

Example

DNS record:

_mta-sts.example.com. IN TXT "v=STSv1; id=20261005T000000"

Policy at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

Start in testing mode, then move to enforce once reports look clean.

Common mistakes

Forgetting to change the id after editing the policy, so senders keep the cached version.
Listing an mx pattern that does not match your real MX hosts and blocking your own mail in enforce mode.
Letting the policy site's HTTPS certificate expire.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.