RFC 8461 — MTA-STS

RFC 8461 defines MTA-STS, the mechanism by which a domain tells sending servers that mail to it must be delivered over authenticated TLS.

It solves a different problem from DMARC. DMARC is about who may claim to be you; MTA-STS is about whether mail to you can be intercepted or downgraded in transit.

How it works

Two pieces have to agree:

• A DNS record at _mta-sts.yourdomain.com, which carries a policy id that changes whenever the policy does.
• A policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, listing the permitted MX hosts, a mode, and a max_age.

The HTTPS requirement is the point: the policy is authenticated by the web PKI, which is what stops an attacker stripping it the way they can strip STARTTLS.

The three modes

Mode
none	No policy in force — used to withdraw one cleanly
testing	Failures are reported via TLS-RPT but mail is still delivered
enforce	Senders must not deliver if TLS validation fails

Go through testing first. enforce with a wrong MX list means mail to you silently stops, and max_age means senders may cache the broken policy for as long as you told them to. Our guide on testing MTA-STS to enforce covers the sequence.

What it does not protect against

MTA-STS covers the connection to your MX hosts. It says nothing about who may claim to be you — that is DMARC — and nothing about mail that has already been delivered.

It also depends on the policy being fetchable. If mta-sts.yourdomain.com stops serving, or its certificate expires, senders fall back to the cached policy until max_age runs out and then treat you as having none. The web server hosting that file is now part of your mail infrastructure.

Publishing it

The DNS record is small:

_mta-sts.yourdomain.com.  IN TXT  "v=STSv1; id=20260808000000Z"

The id must change whenever the policy file changes — that is how senders know to re-fetch rather than trust their cache. Getting that wrong is the quiet failure mode: an updated MX list nobody picks up.

Publish TLS-RPT first, and read the reports before going near enforce.

Read it: rfc-editor.org/rfc/rfc8461