# MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) is a policy that tells sending mail servers to deliver to a domain only over TLS with a valid certificate, preventing downgrade and interception.

## How it works

A TXT record at _mta-sts.domain announces a policy file served over HTTPS at mta-sts.domain/.well-known/mta-sts.txt, listing the allowed MX hosts and the mode (testing or enforce).

TLS-RPT records collect reports about delivery failures.

## How to protect yourself

- Publish MTA-STS in testing mode, read the TLS reports, then switch to enforce.
- Keep the policy's MX list in sync with DNS.

## Related tools

- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)

## Related terms

- [DMARC](https://phishdestroy.io/glossary/dmarc/)
- [SPF](https://phishdestroy.io/glossary/spf/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/mta-sts/