Engineering capabilities
- Policy file hosting over HTTPS with a valid certificate
- DNS policy record and versioning
- Testing mode before enforce mode
- MX and certificate name alignment review
Security & DNS
MTA-STS
Published policy that requires inbound mail servers to use authenticated TLS, closing the downgrade path that plain opportunistic encryption leaves open.
Security & hardening
- Prevents cleartext downgrade and interception of inbound mail
- Certificate expiry monitored so policy never breaks delivery
- Policy changes versioned and logged
MTA-STS policy delivery
A policy file served over HTTPS plus a DNS record tells sending servers that TLS is mandatory for your domain.
-
01
Policy host
- mta-sts subdomain
- HTTPS with valid certificate
- Policy file
The policy is only trusted when it is fetched over a properly validated certificate.
-
02
DNS
- _mta-sts TXT record
- Policy id versioning
- TTL control
Version id changes whenever the policy file changes, so senders refresh.
-
03
Modes
- testing
- enforce
- none
Testing collects reports without risking delivery; enforce is applied once clean.
-
04
Assurance
- MX name match
- Certificate expiry monitoring
- TLS-RPT reports
Certificate expiry on the MX hosts becomes a delivery issue, so it is monitored.
Frequently asked questions
Can MTA-STS break inbound mail?
Only if a certificate on an MX host expires or a name no longer matches the policy. Both are monitored, and testing mode is used first for exactly this reason.
Do we still need DANE?
DANE requires DNSSEC and is used where the provider supports it. MTA-STS is the practical option for most hosted mail platforms.
Who enforces the policy?
The sending server. MTA-STS is a statement to other mail servers about how they must connect to you.
Scope the work before you commit budget
Send the environment details and get an engineered proposal with assumptions, risks and a rollback path.