What Is MTA-STS?
MTA-STS forces encrypted email delivery to your domain, closing a gap attackers exploit. Here's what it is and how to set it up.
TL;DR
MTA-STS lets your domain require TLS for inbound mail, preventing downgrade attacks. Publish a policy via DNS and HTTPS. It complements SPF/DKIM/DMARC on the security side.
The problem MTA-STS solves
SMTP's STARTTLS is opportunistic — if encryption can't be negotiated, mail often falls back to plaintext, which attackers can exploit with downgrade or man-in-the-middle attacks. MTA-STS lets you say "only deliver to me over TLS."
How it works
You publish two things:
- A DNS TXT record at
_mta-sts.yourdomain.comannouncing a policy exists. - A policy file served over HTTPS at
https://mta-sts.yourdomain.com/.well-known/mta-sts.txtspecifying enforcement mode and your MX hosts.
Policy modes
| Mode | Behaviour |
|---|---|
| none | No policy in effect |
| testing | Report failures, still deliver |
| enforce | Require TLS or don't deliver |
Start in testing with TLS reporting, then move to enforce.
MTA-STS vs DANE
Both enforce TLS; MTA-STS uses HTTPS/DNS and is easier to deploy without DNSSEC, while DANE requires DNSSEC. Most senders find MTA-STS simpler.
Does it affect sending?
MTA-STS primarily protects inbound mail to your domain. As a sender, honour other domains' MTA-STS policies — modern MTAs like PowerMTA handle TLS negotiation for you.
AutoPMTA automates SSL/TLS for your mail stack so transport security is covered. View plans.
Key takeaways
- MTA-STS enforces TLS for inbound mail, blocking downgrades.
- Published via a DNS record plus an HTTPS policy file.
- Start in testing mode, then move to enforce.
- Easier to deploy than DANE (no DNSSEC required).
Frequently asked questions
What is MTA-STS used for?+
MTA-STS lets a domain require that inbound email be delivered over TLS encryption, preventing downgrade and man-in-the-middle attacks that exploit SMTP's opportunistic encryption.
How do I set up MTA-STS?+
Publish a DNS TXT record at _mta-sts.yourdomain.com and host a policy file over HTTPS at /.well-known/mta-sts.txt listing your MX hosts and enforcement mode. Start in testing, then move to enforce.
What's the difference between MTA-STS and DANE?+
Both enforce TLS for mail. MTA-STS uses DNS plus an HTTPS policy and doesn't require DNSSEC, while DANE relies on DNSSEC. MTA-STS is generally simpler to deploy.