Mail transport security
What is MTA-STS and why your domain needs it
Updated September 15, 2026 · 5 min read
Email between mail servers is supposed to travel over an encrypted TLS connection. The catch is that standard mail delivery falls back to an unencrypted connection if the encrypted one is unavailable, and it does so silently. An attacker positioned between two servers can force that fallback and read or alter the mail. MTA-STS is the standard that closes this gap for your domain.
The problem MTA-STS solves
When one mail server delivers to another, it looks up the recipient domain's mail servers and tries to negotiate TLS. Classic SMTP treats encryption as optional. If the handshake fails, or appears to fail, the sending server delivers in the clear rather than not at all. This is called a downgrade. An active attacker can trigger it deliberately by tampering with the connection, and neither side gets a warning.
MTA-STS lets your domain declare that senders must use TLS with a valid certificate, and must not deliver at all if they cannot. That turns a silent downgrade into a refused delivery, which is the safe failure.
How it works
MTA-STS has two moving parts. A DNS TXT record announces that your domain has a policy. A policy file, served over HTTPS at a fixed address on a subdomain, states which mail servers are valid and what mode to enforce. Sending servers fetch the policy, cache it, and apply it to future mail.
- A TXT record at _mta-sts.yourdomain announces the policy and its version id.
- A policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt lists your MX hosts and the mode.
- A companion TLS-RPT record at _smtp._tls.yourdomain asks receivers to send you reports about TLS failures, so you can watch for problems.
Testing mode, then enforce
MTA-STS has two modes. In testing mode, senders honour the policy but still deliver if TLS fails, and they report the failure. In enforce mode, they refuse to deliver over an insecure connection. Always start in testing mode for a week or two and watch the TLS reports. Once the reports are clean, switch to enforce. If you ever change mail providers, drop back to testing before the change and re-enforce afterward, because senders cache the policy for up to a week.
The one operational cost of MTA-STS is that the policy file must be served over HTTPS on a subdomain, which means a certificate and a place to host it. Most companies do not want to stand up a web server for a text file, which is why hosted MTA-STS exists.
Turning it on without running a server
PhantomStrike can host the policy file for you. You add three DNS records, we serve the policy over HTTPS and keep the certificate valid, and you move from testing to enforce with a click when the reports look good. The scan shows whether your domain has MTA-STS today and what is missing.
See your domain the way an attacker does
Run a free scan for your exposure score and the exact records that fix each finding. No account, and we never touch your systems.
Scan your domain freeCommon questions
Does MTA-STS replace DMARC?
No. They protect different things. DMARC stops someone forging your domain in the From line. MTA-STS stops mail to your domain being downgraded to an unencrypted connection in transit. A well-protected domain has both.
Will MTA-STS break my email?
Not if you start in testing mode and watch the TLS reports before enforcing. Testing mode never blocks delivery; it only reports. You only enforce once the reports confirm your mail servers negotiate TLS cleanly.
What does the policy file need?
It must be served over HTTPS at mta-sts.yourdomain with a valid certificate, and list your current MX hosts. If those hosts change, the policy has to be updated.