MTA-STS
SMTP MTA Strict Transport Security: a policy, signalled in DNS and served over HTTPS, telling sending servers to deliver to a domain only over authenticated TLS.
What it means
MTA-STS (RFC 8461) closes the gap in opportunistic TLS. The domain publishes a TXT record at _mta-sts announcing a policy, and serves the policy file at https://mta-sts.domain/.well-known/mta-sts.txt. The file lists the valid MX host names, a mode and a cache lifetime.
A sending server that supports it fetches and caches the policy. In enforce mode it delivers only to listed MX hosts that offer STARTTLS with a valid certificate matching the host name; otherwise it holds the mail and retries. In testing mode it delivers anyway and reports failures through TLS-RPT.
Unlike DANE, it needs no DNSSEC, relying on the web certificate system instead. Exchange Online validates MTA-STS on all outbound mail and supports it for inbound domains.
Example
_mta-sts.example.com. TXT "v=STSv1; id=20261021T120000"Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)rfc-editor.org
- Microsoft Learn: Enhancing mail flow with MTA-STSlearn.microsoft.com
- NIST SP 800-177 Rev. 1: Trustworthy Emailcsrc.nist.gov
All 432 terms in the glossaryThe wiki: blocklists and bounce codes