What is MTA-STS?
Also called: SMTP MTA Strict Transport Security
MTA-STS lets a domain declare that incoming mail must arrive over an authenticated TLS connection, using a policy file published over HTTPS. It closes a gap in SMTP where encryption is opportunistic and can be stripped by an attacker sitting between two mail servers.
SMTP encryption is negotiated with STARTTLS, which is advertised in plain text and can be removed in transit. Without a policy, a sending server that sees no STARTTLS offer falls back to sending unencrypted.
MTA-STS removes that fallback. The policy is published at https://mta-sts.example.com/.well-known/mta-sts.txt and names the valid MX hosts, so a sending server that supports it refuses to deliver over an unauthenticated connection instead of downgrading.
The policy has three modes. testing asks senders to report failures but still deliver, enforce asks them to refuse delivery that fails, and none withdraws the policy. Start in testing, and pair it with TLS reporting (TLS-RPT) so you hear about failures.
It protects mail coming in to you, unlike SPF, DKIM and DMARC, which protect your outgoing identity. Treat it as security hardening rather than a deliverability lever: it will not change inbox placement.
Example
_mta-sts.example.com TXT "v=STSv1; id=20261013" plus the policy file with mode: enforce.Go deeper
Sources
By SimpleVerifier Team · Last reviewed 2026-10-13 · All 50 glossary terms