REQUIRETLS
An SMTP extension (RFC 8689) by which a sender requires that one message travel only over validated TLS on every hop, or bounce.
What it means
MTA-STS and DANE are set by the receiving domain. REQUIRETLS lets the sender decide per message. A client adds REQUIRETLS to the MAIL FROM command, and every hop must then use TLS, validate the next server's name through MTA-STS or DNSSEC, verify its certificate, and see REQUIRETLS advertised by the next server. If no path meets that, the message is returned with 5.7.30 (REQUIRETLS not supported) or 5.7.10 (encryption needed).
The same RFC defines a TLS-Required: No header, the opposite request: deliver even if the recipient's MTA-STS or DANE policy would block it, for example a security alert about a broken certificate.
Example
MAIL FROM:<alerts@example.com> REQUIRETLSRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8689: SMTP Require TLS Optionrfc-editor.org
- RFC 8689: SMTP Require TLS Option, section 3rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes