MTA-STS

SMTP MTA Strict Transport Security (MTA-STS) is a DNS-based mechanism that enforces TLS encryption for inbound email to a domain. A receiving domain publishes an MTA-STS policy at _mta-sts.yourdomain.com plus a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Sending mail servers fetch the policy, verify the recipient domain's TLS certificates, and refuse to deliver mail in plaintext if the policy is enforced. Mitigates downgrade attacks where an attacker tampers with SMTP traffic to force unencrypted delivery. Microsoft 365 supports MTA-STS for inbound mail to your accepted domains; TLS-RPT (TLS Reporting) provides reporting on TLS failures.

Worked example

An organisation handling sensitive client correspondence publishes an MTA-STS policy in enforce mode for its accepted domains. A misconfigured partner mail server later tries to deliver mail with an expired TLS certificate; instead of silently falling back to an unencrypted or unauthenticated connection the way SMTP traditionally would, the sending server refuses to deliver the message at all, because MTA-STS in enforce mode makes plaintext or improperly-authenticated delivery a hard failure rather than a quiet downgrade. The organisation finds out about the problem through a TLS-RPT report rather than a client calling to ask why their message never arrived.

Common pitfalls

Publishing an MTA-STS policy directly in enforce mode without first running in testing mode is risky — any misconfiguration in the policy itself, or an unrelated certificate issue on the receiving side, can start silently rejecting legitimate inbound mail with no warning, whereas testing mode surfaces the same failures as reports without actually blocking delivery. Forgetting that MTA-STS only protects inbound mail to the domain that published the policy is a common scope confusion — it says nothing about how that domain's own outbound mail is protected, which is a separate consideration entirely. And treating MTA-STS as a replacement for SPF, DKIM, and DMARC rather than a complement to them misunderstands its job — MTA-STS enforces transport-layer encryption between mail servers, it doesn't authenticate sender identity or prevent spoofing on its own.