MTA-STS (RFC 8461) prevents TLS downgrade attacks.
Two components required:
- DNS TXT record at
_mta-sts.<domain> - Policy file at
https://mta-sts.<domain>/.well-known/mta-sts.txt
Policy file specifies mode (testing or enforce), authorized MX hostnames, and max-age.
Limitation: First policy fetch is unprotected (TOFU — Trust On First Use).
TLS-RPT (RFC 8460) provides visibility into TLS failures:
- DNS TXT record at
_smtp._tls.<domain> - Receives JSON-formatted daily reports
- Reports successful connections, failure details, affected servers
Sign in to keep track of what you have read.