MTA-STS — SMTP MTA Strict Transport Security

What MTA-STS means

STARTTLS is opportunistic: a sender that cannot negotiate TLS delivers in the clear instead, and anyone positioned between the two can strip the offer to force exactly that. MTA-STS — SMTP MTA Strict Transport Security, RFC 8461 — closes the gap by moving the requirement somewhere an attacker on the SMTP path cannot rewrite — a file fetched over HTTPS with a certificate the sender validates.

It has two pieces. A TXT record at _mta-sts.example.com reading v=STSv1; id=20260101000000 announces that a policy exists, and its id changes whenever the policy does. The policy itself is served at https://mta-sts.example.com/.well-known/mta-sts.txt with the fields version: STSv1, mode:, one mx: line per permitted host, and max_age: in seconds. A sender caches the policy for max_age and keeps enforcing it even if the DNS record later disappears.

Publishing mode: testing applies nothing and reports everything, which is what TLS-RPT is for — collect the failures that would have occurred before switching to mode: enforce. The trap is that cache: a policy cached for a fortnight outlives a hurried MX change, so add a new host to the mx: list and let the cache turn over before mail actually moves there.