DE EN IT

~/glossary / E-mail

MTA-STS

MTA-STS is a standard that lets a domain publish that inbound mail must only be delivered to its MX servers over TLS with a valid certificate.

daniele@mikweb: ~/glossary — man mta-sts

MTA-STS has two parts: a TXT record at _mta-sts.example.com with an ID, and a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt. The file lists the allowed MX names, the mode and how long the policy is valid.

In testing mode problems are only reported (via TLS-RPT); in enforce mode sending servers refuse delivery when TLS is missing or the certificate does not match the MX name. This blocks STARTTLS stripping and redirection to fake servers.

Typical mistakes: the MX certificate does not cover the hostname, the policy file is not reachable over HTTPS, or the ID in the TXT record was not changed after an MX change.

Example

curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
daniele@mikweb: ~/glossary — ls

Related terms

STARTTLSSTARTTLS is a command that upgrades an initially unencrypted connection (SMTP, IMAP, POP3) to TLS.TLSTLS (Transport Layer Security) is the protocol that encrypts connections and proves the server's identity with certificates; it replaced SSL.MX recordAn MX record lists the mail servers that accept email for a domain, each with a priority.DMARCDMARC is a DNS policy that tells receivers how to handle email whose From domain is not confirmed by SPF or DKIM.

← All terms