SMTP MTA Strict Transport Security (RFC 8461) — discover a policy via DNS and force receivers to use TLS when accepting mail, defending against STARTTLS downgrade attacks. Generate the _mta-sts TXT record and policy file.
RFC 8461 §3: MTA-STS policies apply per receiving domain; use no protocol prefix or subdomain (the policy covers all MX hosts of the domain).
RFC 8461 §3.2: start with testing plus TLS-RPT for 1-2 weeks, then switch to enforce once no failures are observed.
RFC 8461 §3.2: mx hosts in the policy must match DNS MX records (wildcards like *.example.com allowed). Leave empty to infer from DNS (verify manually afterwards).
RFC 8461 §3.2: seconds receivers cache the policy. Recommended 86400 (1 day) to 604800 (1 week). Shorter during testing.
MTA-STS (RFC 8461) solves STARTTLS's inherent flaw: during the plaintext negotiation an active attacker can strip the TLS extension and downgrade the connection. MTA-STS hosts a policy file over HTTPS so receiving MTAs know before connecting that "this domain must use TLS".
Three components are required:
① DNS TXT record: hostname _mta-sts.yourdomain.com, value v=STSv1; id=timestamp. Receivers re-fetch the policy when the id changes.
② Policy file: hosted at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, requires an HTTPS certificate (wildcard or Let's Encrypt works), MIME type text/plain.
③ TLS configuration: all MX hosts must support TLS 1.2+ with a valid certificate chain. Also configure TLS-RPT to receive failure reports.
Notes: MTA-STS relies on an "HTTPS trust anchor" rather than DNSSEC; if you cannot get a certificate for the mta-sts subdomain, consider DANE (RFC 7672, requires DNSSEC) as an alternative. The two mechanisms are complementary.
Standards: RFC 8461 (MTA-STS), RFC 8460 (TLS-RPT), RFC 7672 (DANE SMTP), RFC 3207 (STARTTLS).