What is MTA-STS?

How MTA-STS works

The trick in MTA-STS is publishing the requirement in two places a network attacker cannot tamper with at the same time, and making the sender hold that requirement before it needs it.

Source: RFC 8461, the official MTA-STS specification published by the IETF, which defines the two-part publication (the _mta-sts record and the mta-sts.txt file served over HTTPS), the three policy modes and the max_age field.

Where MTA-STS stops

• It depends on whoever sends. The policy is a declared requirement, and the one who honors it is the sender's server. A provider that has not implemented the standard simply does not see it, and delivers as it always did.
• The policy you publish protects inbound, not outbound. It states how the world should talk to your domain. Protecting what you send is the other half of the standard: it depends on your servers reading the destinations' policies, and on those destinations publishing one at all.
• It runs on infrastructure of its own. It needs an mta-sts hostname published, an HTTPS site with a valid certificate serving the file, and a DNS record consistent with it. If that site's certificate expires, the policy vanishes for anyone who had not cached it yet.
• It does nothing in testing mode. This is the rung where most stop, and it is worth spelling out: in testing the policy exists, shows up in any check, and prevents not a single insecure delivery.

The three policy modes

• none Declares the domain no longer maintains an active policy. It exists so you can opt out cleanly, telling senders who cached the previous policy, rather than simply deleting everything and breaking deliveries.
• testing The policy exists and requires nothing. Senders implementing TLS reporting report the failures they would have hit, but deliver the message regardless of the validation result. It is the measurement phase, and it is where nearly half the domains that publish sit parked.
• enforce The only mode that protects. The sender is obliged to refuse delivery to a server that fails validation or does not support switching to an encrypted channel. This is where the announcement-stripping attack stops working: deleting the 250 STARTTLS line from the conversation no longer makes the sender fall back to plain text, it makes the delivery be refused.
• The max_age field Not a mode, but what gives the three their force: it sets how long the sender holds the policy. Too short a lifetime reopens the attack window at every expiry; the standard allows up to 31,557,600 seconds, roughly a year.

Published is not the same as in force

The numbers on this standard tell an arithmetic story. Out of every thousand top internet domains, seven publish the policy. Of those seven, four stopped at testing mode. And of every five published deployments, one does not even pass validation. Multiply the three cuts together and the total number of domains that genuinely refuse an insecure delivery is a small fraction of a number that was already small. And it is not a queue moving forward: the split between modes has stayed remarkably stable across three years of the survey, which suggests testing mode stopped being a stage and became a destination. For a buyer, and for whoever answers for the environment itself, the practical consequence is the same: knowing that a domain has MTA-STS authorizes no conclusion at all about how protected it is, and the only question that returns information is which mode the policy is in.

How to reach enforce without losing email

The sequence exists because getting this wrong does not fill a spam folder, it makes legitimate mail stop being delivered. Five steps, in this order:

1. Fix your inbound servers' certificates firstThe validation the sender will run is against your mail server's name. An expired certificate, or one whose name does not match, fails, and under enforce failing means the message is refused.
2. Publish TLS reporting firstIt is the instrument. Without it you enter enforcement blind to who was failing, and you discover the list of those affected the worst way possible, one at a time, as they complain.
3. Start in testing mode and read what comes backLet testing do its actual job, which is to measure, for a few weeks. What shows up there is the list of what must be fixed before you require anything.
4. Move to enforce with a short cache lifetime at firstA smaller max_age early on lets you back out quickly if something slips through. Once stable, raise it, because a long lifetime is what genuinely protects.
5. Treat the policy site as a production serviceIf the certificate on mta-sts.yourdomain.com expires, the policy vanishes for anyone who had not cached it. It is a monitoring item, not a static file you publish and forget.

Frequently asked questions about MTA-STS