MTA-STS: Enforcing TLS Encryption for Email

What is MTA-STS?

MTA-STS is a security standard that allows domain owners to declare that their mail servers support TLS encryption and that sending servers should refuse to deliver email if a secure connection cannot be established. It prevents man-in-the-middle attackers from intercepting or tampering with email in transit.

Without MTA-STS

Attackers can force email to be sent unencrypted (TLS downgrade attack)

With MTA-STS

Email delivery fails safely rather than falling back to unencrypted transmission

Why MTA-STS Matters

By default, email servers use "opportunistic TLS" - they attempt to encrypt connections but will fall back to unencrypted transmission if TLS fails. This creates a vulnerability:

An attacker positioned between mail servers can strip TLS from the connection, forcing emails to be sent in plain text where they can be read or modified.

Prevents TLS Downgrade Attacks

Sending servers will refuse to deliver email if they cannot establish a valid TLS connection.

Validates Server Certificates

MTA-STS requires valid certificates, preventing attackers from using self-signed or forged certificates.

Protects Against DNS Spoofing

The policy is served over HTTPS, providing an additional layer of authentication beyond DNS.

How MTA-STS Works

MTA-STS uses a combination of DNS and HTTPS to publish and verify your email security policy:

DNS TXT Record - A TXT record at _mta-sts.yourdomain.com signals that your domain has an MTA-STS policy
HTTPS Policy File - The actual policy is hosted at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
Sending Server Lookup - When sending email, the sending server checks the DNS record and fetches the policy over HTTPS
Policy Enforcement - The sending server enforces the policy, requiring TLS and valid certificates for delivery

Setting Up MTA-STS

Step 1: Create the DNS TXT Record

Add a TXT record at _mta-sts.yourdomain.com:

Host: _mta-sts
Type: TXT
Value: v=STSv1; id=20240115120000

The id field is a unique identifier that should be updated whenever you change your policy. A timestamp format (YYYYMMDDHHmmss) works well.

Step 2: Create the Policy File

Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: mail.yourdomain.com
mx: backup-mail.yourdomain.com
max_age: 604800

Policy Fields

version - Must be "STSv1"
mode - Either "testing", "enforce", or "none"
mx - List of your MX hostnames (wildcards supported, e.g., *.yourdomain.com)
max_age - How long (in seconds) sending servers should cache the policy (604800 = 1 week)

Step 3: Configure HTTPS Hosting

The policy file must be served over HTTPS with a valid certificate. You can host this on a subdomain of your main domain, a CDN, or a static hosting service. The certificate must be valid formta-sts.yourdomain.com.

MTA-STS Modes

MTA-STS supports three modes to help you safely roll out the policy:

mode: testingRecommended to start

Sending servers will attempt TLS and report failures, but will still deliver email even if TLS fails. Use this mode initially to identify any issues before enforcing.

mode: enforceFull protection

Sending servers will refuse to deliver email if they cannot establish a valid TLS connection. Only enable this after confirming your setup works correctly in testing mode.

mode: noneDisabled

Effectively disables MTA-STS. Useful if you need to temporarily disable the policy without removing DNS records.

Recommended approach: Start with testing mode for 2-4 weeks while monitoring TLS-RPT reports, then switch to enforce.

Combining with TLS-RPT

TLS-RPT (TLS Reporting) is a companion specification that allows you to receive reports about TLS connection failures. It's highly recommended to set up TLS-RPT alongside MTA-STS to monitor for issues.

Host: _smtp._tls
Type: TXT
Value: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com

With TLS-RPT configured, you'll receive daily reports from sending mail servers about:

Successful TLS connections to your mail servers
Failed TLS negotiations and the reasons for failure
Certificate validation errors
MTA-STS policy fetch failures

Learn more about TLS-RPT in our Knowledge Base.

Summary

1.Create a DNS TXT record at _mta-sts.yourdomain.com with your policy ID
2.Host your policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
3.Start with "testing" mode to identify issues before enforcing
4.Set up TLS-RPT to receive reports about TLS connection failures
5.Switch to "enforce" mode once you've verified everything works correctly

Resources

RFC 8461 - SMTP MTA Strict Transport Security RFC 8460 - SMTP TLS Reporting Google Workspace MTA-STS Documentation