MTA-STS Complete Guide: Enforcing TLS for Email

MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending mail servers that they must use TLS encryption when delivering email to your domain. Without MTA-STS, attackers can intercept emails through man-in-the-middle attacks.

What is MTA-STS?

MTA-STS is a security standard that:

Enforces TLS encryption for inbound email
Prevents downgrade attacks
Ensures secure email delivery
Provides reporting on failures

Why MTA-STS Matters

Without MTA-STS:

Senders may deliver email without encryption
Attackers can intercept emails in transit
Man-in-the-middle attacks possible
No verification of your mail server identity

With MTA-STS:

Senders must use TLS
Connection failures if no TLS available
Encrypted delivery enforced
Certificate validation required

How MTA-STS Works

The Flow

Sender queries your MTA-STS policy via HTTPS
Policy specifies requirements: TLS version, certificate validation
Sender validates your mail server certificate
Sender delivers email over encrypted connection
If TLS fails, sender reports (via TLS-RPT) or retries

Components

DNS TXT record: Points to your policy
Policy file: Hosted at well-known URL
TLS-RPT (optional): Receive delivery failure reports

MTA-STS vs STARTTLS

Feature	STARTTLS	MTA-STS
Encryption	Opportunistic	Enforced
Downgrade attacks	Vulnerable	Protected
Certificate validation	Optional	Required
Policy caching	No	Yes
Failure reporting	No	Yes (TLS-RPT)

Setting Up MTA-STS

Step 1: Verify Prerequisites

Requirements:

Valid TLS certificate for mail server
HTTPS capability on your domain
MX records pointing to your mail servers

Verify your mail server supports TLS:

openssl s_client -starttls smtp -connect mail.example.com:25

Step 2: Create MTA-STS Policy File

File location:

https://mta-sts.example.com/.well-known/mta-sts.txt

Policy content:

version: STSv1
mode: testing
mx: mail.example.com
mx: mail2.example.com
max_age: 604800

Policy parameters:

Parameter	Description	Values
`version`	Protocol version	STSv1
`mode`	Enforcement mode	none, testing, enforce
`mx`	Authorized mail servers	Your MX hostnames
`max_age`	Cache duration (seconds)	86400-31557600

Step 3: Host the Policy

Option A: Subdomain Setup

Create subdomain: mta-sts.example.com
Configure HTTPS with valid certificate
Serve policy at /.well-known/mta-sts.txt

Option B: Redirect

Redirect from mta-sts.example.com to your main domain's well-known path.

Step 4: Add DNS Record

DNS TXT record:

Host: _mta-sts
Type: TXT
Value: v=STSv1; id=20241201000000

Important: Change the id whenever you update the policy.

Step 5: Test Your Implementation

Test tools:

MTA-STS Lookup Tool
MXToolbox MTA-STS checker
Hardenize

Verification checklist:

MTA-STS Modes

Mode: none

mode: none

Effect: MTA-STS disabled Use case: Temporarily disable during troubleshooting

Mode: testing

mode: testing

Effect:

Senders should attempt TLS
Failures reported but not blocked
Email still delivered on failure

Use case: Initial deployment, monitoring

Mode: enforce

mode: enforce

Effect:

Senders must use TLS
Failures cause non-delivery
Maximum security

Use case: Production deployment

Implementation Path

Week 1-2: Testing Mode

Deploy with mode: testing:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

Monitor:

TLS-RPT reports
Email delivery
Certificate issues

Week 3-4: Extended Testing

Increase cache duration:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

Verify:

No delivery issues
All mail servers covered
Certificates valid

Week 5+: Enforcement

Move to enforce mode:

version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800

Monitor continuously.

TLS-RPT: Failure Reporting

TLS-RPT (TLS Reporting) provides reports when TLS delivery fails.

Setting Up TLS-RPT

DNS TXT record:

Host: _smtp._tls
Type: TXT
Value: v=TLSRPTv1; rua=mailto:tls-reports@example.com

Report Contents

TLS-RPT reports include:

Sending domain
Receiving domain
Policy applied
Failure type
Failure count
Time period

Processing Reports

Reports are JSON format:

{
  "organization-name": "Google",
  "date-range": {
    "start-datetime": "2024-01-01T00:00:00Z",
    "end-datetime": "2024-01-02T00:00:00Z"
  },
  "policies": [{
    "policy": {
      "policy-type": "sts",
      "policy-domain": "example.com"
    },
    "summary": {
      "total-successful-session-count": 1000,
      "total-failure-session-count": 5
    }
  }]
}