What is MTA-STS?

The problem it solves is that STARTTLS can be stripped in transit. An attacker sitting between two servers removes the offer, both sides shrug, and the message crosses the internet in plain text with nobody alerted.

MTA-STS moves the requirement out of band. You publish a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing your MX hosts and a mode, plus a small TXT record at _mta-sts carrying a version ID.

The certificate is the point of trust. A sending server fetches your policy over HTTPS, so it cannot be tampered with, then holds you to it: matching MX host, valid certificate, TLS or no delivery.

Run mode: testing first and pair it with TLS reporting. You get failure reports without losing mail, and only after a quiet two weeks do you switch to enforce.

Picture a company whose policy file has said this for a year: version: STSv1, mode: enforce, mx: mail.oldhost.example, max_age: 604800. On Friday evening they move to a new mail provider and update their MX records. Nobody remembers the policy file, which still names the old host.

Over the weekend, Gmail and other senders that honor MTA-STS look up the new MX and compare it with the policy they cached. The host doesn't match, the mode is enforce, and so they refuse to deliver. Mail queues on the sending side and customers eventually see delay notices.

Fixing the file on Monday isn't enough by itself. Senders keep the old policy for up to max_age, a week in this case, unless they notice a change. They check for one by reading the id value in the _mta-sts TXT record, so you have to update both: the file, and a new id.

MTA-STS covers mail coming in to your domain, and only from senders that support it. Google and Microsoft both do. A small sender running older software will ignore your policy and deliver the way it always has, with or without encryption, so you're protected against downgrade attacks from the big providers and not from everyone.

It says nothing about mail you send, which depends on the policies other domains publish. Nor does it encrypt messages at rest, and it won't stop a server along the path from reading mail once it's been delivered. The protection applies to one hop.

Pair it with TLS reporting so you aren't flying blind. A TXT record at _smtp._tls.yourdomain.com with v=TLSRPTv1; rua=mailto: and an address asks senders for a daily summary of successes and failures. During a testing period those reports are the only way to know whether enforce mode would have cost you mail.