SuperMailOS
← Learn

Email security

What is MTA-STS? SMTP TLS enforcement, explained

SMTP is old. By default, server-to-server mail tries opportunistic TLS: encrypt if both sides agree, fall back to plaintext if anything fails. That fallback is the hole — an attacker who can interfere with the connection can force the downgrade and read mail in transit. MTA-STS closes it by letting your domain say: my mail servers always speak TLS, refuse cleartext delivery.

The two parts

1. The DNS record — a TXT record at _mta-sts.yourcompany.com:

_mta-sts.yourcompany.com.  3600  IN  TXT  "v=STSv1; id=2026080101"

The id is a version stamp — senders refetch the policy when it changes. That's all DNS carries; it's just the pointer.

2. The policy file — served over HTTPS at https://mta-sts.yourcompany.com/.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: mx.yourcompany.com
max_age: 604800

mode: enforce is the point — under testing, failures are only reported; under enforce, senders must not deliver over cleartext. HTTPS on the policy host is required ( the whole security model depends on it ), and max_age caps how long senders cache the policy.

Why the dance is built this way

DNS alone can't carry the policy securely without DNSSEC everywhere, and HTTPS alone can't be discovered. MTA-STS splits the job: DNS announces the policy exists; HTTPS ( with a real certificate ) delivers its contents. Senders match the MX they're about to deliver to against the policy's mx list before connecting.

TLS-RPT: the reporting half

A second TXT record at _smtp._tls.yourcompany.com asks senders to report delivery failures — who failed TLS, and why. Without it, mode: testing teaches you nothing, and even enforce fails silently. Deploy them as a pair.

Deploying it safely

  1. Confirm your MX endpoints really serve TLS 1.2+ with valid certificates. Mismatched certs are the #1 self-inflicted MTA-STS outage.
  2. Publish TLS-RPT first, run MTA-STS in testing for a week or two, read the reports.
  3. Flip to enforce with a modest max_age ( a day or a week, not six months ) so a mistake is recoverable.

On SuperMailOS, MTA-STS and TLS-RPT records are generated with the rest of the DNS zone during domain setup, so inbound TLS enforcement is on by default rather than a weekend project. You can check any domain's current MTA-STS posture free with the email deliverability checker; the full DNS record landscape is in the complete guide to email DNS records.

Related