Your domain doesn't publish an MTA-STS policy. MTA-STS (RFC 8461) tells sending mail servers that your domain requires TLS for inbound mail, preventing downgrade attacks where attackers strip encryption from SMTP connections.
Publish a _mta-sts TXT record and an HTTPS-served policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.
SMTP STARTTLS is opportunistic by default — if encryption fails, the message is delivered in cleartext. This makes it possible for attackers on the network path to strip TLS and intercept mail. MTA-STS lets your domain publish a policy saying "all mail to me must use TLS," which compliant senders (Google, Microsoft, Yahoo) will enforce.
Without MTA-STS, your inbound email can be downgraded to plaintext by an attacker on the network path. Mailing lists, password resets, financial documents, and confidential communications can be intercepted. MTA-STS is increasingly expected by enterprise security questionnaires, and it's a precondition for some compliance frameworks. Google and Microsoft both honor MTA-STS for outbound mail to your domain.
Add a TXT record at _mta-sts.yourdomain.com that announces your policy version. The id changes each time you update the policy, so receivers know to re-fetch.
_mta-sts.yourdomain.com IN TXT "v=STSv1; id=20260415000000Z"You need to serve the policy over HTTPS at a specific hostname. Most setups use a CNAME to a CDN or a static host.
mta-sts.yourdomain.com IN CNAME yourdomain.com.
# or:
mta-sts.yourdomain.com IN A 192.0.2.10The policy file must be served at /.well-known/mta-sts.txt with a valid TLS certificate. Content lists your MX hosts and the enforcement mode.
# Path: https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: mail.yourdomain.com
mx: *.yourprovider.com
max_age: 86400Initial mode should be "testing" — receivers report TLS failures via TLS-RPT but don't reject mail. Once you see clean reports for 1-2 weeks, switch to "enforce".
mode: testingmode: enforceTLS-RPT (RFC 8460) sends you reports when senders' TLS to your MX fails. Critical for monitoring MTA-STS in testing mode.
_smtp._tls.yourdomain.com IN TXT "v=TLSRPTv1; rua=mailto:[email protected]"After making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.
Both protect inbound SMTP TLS. MTA-STS uses HTTPS-served policy and DNS, requires no DNSSEC. DANE uses DNSSEC + TLSA records, more cryptographically rigorous but harder to deploy. Most operators choose MTA-STS for ease.
No. MTA-STS deliberately avoids DNSSEC to lower deployment friction. It uses HTTPS for trust on the policy file.
Only attacks where compliant senders (Google, Microsoft, Yahoo, others) deliver to your domain. Senders that don't support MTA-STS can still be downgraded. But the major mailbox providers all enforce it.
More Security Headers resources — tools to verify, setup guides, deeper reading, and compliance context.