What it is
MTA-STS lets a receiving domain declare that its MX hosts support TLS with a valid certificate. The policy lives at https://mta-sts.example.com/.well-known/mta-sts.txt and a _mta-sts TXT record announces its version.
Why it matters
Opportunistic STARTTLS can be stripped by anyone on the path, and the sender falls back to plaintext without telling anyone. An enforced policy makes senders refuse delivery to a host that cannot prove it is the real MX.
How to implement
Offer STARTTLS on every MX host with a certificate from a public CA that matches its hostname. Serve the policy over HTTPS with version: STSv1, mode, every mx pattern, and max_age. Publish _mta-sts.example.com TXT "v=STSv1; id=…" and change the id whenever the policy changes. Start in testing mode with TLS reporting, then move to enforce.
Common mistakes
- Leaving the policy in
testingmode for good. - Adding or renaming an MX host without updating the
mxlines. - Updating the policy file but not the
id, so senders keep the cached version. - Serving the policy from a host whose own certificate is invalid.
Verification
Fetch the policy over HTTPS, confirm every current MX matches an mx line, and check each MX presents a valid certificate after STARTTLS. Watch TLS reports for failures before and after switching to enforce.