Question 1

What is MTA-STS and why is it necessary for email security?

Accepted Answer

MTA Strict Transport Security (RFC 8461) enables domain owners to declare that inbound emails MUST be delivered over encrypted TLS connections with valid public certificates. Because traditional SMTP STARTTLS is opportunistic, active network adversaries can strip the STARTTLS command in transit (STRIPTLS downgrade attack) and intercept emails in plain text. MTA-STS prevents this downgrade.

Question 2

What is the difference between 'testing' and 'enforce' mode?

Accepted Answer

In 'testing' mode, sending mail servers report TLS negotiation failures via TLS-RPT (RFC 8460) but still deliver messages over cleartext if TLS cannot be negotiated. In 'enforce' mode, sending mail servers refuse to deliver messages if TLS negotiation fails or certificate verification fails, preventing cleartext interception.

Question 3

What is TLS-RPT (RFC 8460)?

Accepted Answer

TLS Reporting (TLS-RPT) enables receiving mail systems to receive aggregated JSON failure reports from major email senders (such as Google and Microsoft) when inbound TLS connections fail or downgrade attacks occur.

Question 4

Why does my MTA-STS policy require an HTTPS certificate?

Accepted Answer

MTA-STS policies are retrieved over HTTPS at https://mta-sts.{domain}/.well-known/mta-sts.txt. RFC 8461 requires this endpoint to present a valid, publicly trusted TLS certificate without any HTTP redirects to ensure that attackers cannot forge or tamper with the security policy.

Email Transport Encryption & STRIPTLS Downgrade Defense

Why Opportunistic STARTTLS Fails

How MTA-STS Enforces Cryptographic Privacy