MTA-STS
MTA-STS publishes requirements for TLS connections to a mail domain. Mail servers, certificates and the policy actually applied belong together.
MTA-STS stands for SMTP MTA Strict Transport Security. A receiving mail domain uses it to publish requirements for the TLS-protected SMTP connection and permitted mail servers. The policy is provided over HTTPS and announced through a DNS record.
Connect the policy to mail operations
In the fictional check design, a company changes the receiving mail server for sending route T-654. The team checks whether the new server matches the published policy and presents a suitable certificate. Being able to retrieve the policy does not by itself confirm this mail server’s behaviour.
In enforce mode, an MTA-STS-aware sender with a valid policy must not deliver to hosts that fail the specified checks. Delivery may therefore be delayed; this does not automatically mean a permanently lost message. Testing mode has a different effect and must be chosen deliberately.
Define the protection’s scope correctly
MTA-STS concerns transport between the participating mail servers. It does not encrypt message content end to end to the person reading it, and it does not replace SPF, DKIM or DMARC checks. Plan changes with the affected services and examine the observed errors as well.
Sources
Related terms
- TLS-RPTTLS-RPT provides aggregate feedback on TLS connections between mail servers. Reports help investigate transport failures, not prove that mail was read.
- MX recordAn MX record names a mail server for a domain. Its preference value orders possible destinations; it confirms neither a mailbox nor delivery.
- Email deliverabilityDeliverability is about whether expected email actually reaches the inbox. Check sending status, authentication and actual receipt separately.
- Return-PathReturn-Path records the SMTP reverse path in a header. It explains the technical route for error reports, not a person’s identity.
- Envelope-FromEnvelope-From identifies the SMTP sender for transport and error feedback. It must be distinguished from the visible sender address.
- DMARC aggregate reportA DMARC aggregate report summarises a reporting mail system’s domain checks over a period. It helps examine sending sources and misconfigurations.
Articles on this topic
Cloud & Operations with ASES
Hosting, deployment, maintenance and support