MTA-STS
also: MTA-STS policy, RFC 8461
MTA-STS (Mail Transfer Agent Strict Transport Security) is a security protocol that forces mail servers to use encrypted TLS connections when sending emails, preventing downgrade attacks and eavesdropping.
MTA-STS is an IETF standard (RFC 8461) that allows domain owners to publish a policy telling other mail servers: "Always use TLS encryption when sending mail to our domain, and verify our certificate." Without it, an attacker can intercept the initial connection and trick the sending server into falling back to unencrypted SMTP.
The policy is published in two ways: as a DNS TXT record (the MTA-STS announcement) and via an HTTPS endpoint at mta-sts.yourdomain.com/.well-known/mta-sts.txt that contains detailed rules. For example, a policy might specify mode: enforce to reject unencrypted connections, or mode: testing to allow failures while monitoring.
Unlike STARTTLS alone, MTA-STS prevents attackers from downgrading to plaintext SMTP. It's increasingly important for organizations protecting email security and is often paired with DANE (DNS-based Authentication of Named Entities) for stronger certificate validation.