MTA-STS
MTA-STS (Mail Transfer Agent Strict Transport Security) is a policy that tells sending mail servers to deliver to a domain only over TLS with a valid certificate, preventing downgrade and interception.
How it works
A TXT record at _mta-sts.domain announces a policy file served over HTTPS at mta-sts.domain/.well-known/mta-sts.txt, listing the allowed MX hosts and the mode (testing or enforce).
TLS-RPT records collect reports about delivery failures.
How to protect yourself
- Publish MTA-STS in testing mode, read the TLS reports, then switch to enforce.
- Keep the policy's MX list in sync with DNS.