🔒

MTA-STS Checker

Mail Transfer Agent Strict Transport Security ensures emails are always delivered over encrypted TLS connections.

RFC: RFC 8461
REQUIREMENTS: DNS TXT + HTTPS Policy File
PORT: 443 / 25

What is MTA-STS Checker?

Historically, email is sent in plaintext if the receiving server doesn't support encryption. MTA-STS forces sending servers to use secure TLS encryption, preventing man-in-the-middle attackers from downgrading the connection to read emails.

How it Works

The domain owner publishes a DNS TXT record at `_mta-sts.domain.com` indicating support, and hosts a text-based policy file on an HTTPS subdomain (`mta-sts.domain.com/.well-known/mta-sts.txt`). Senders check this file and refuse to send unencrypted email if mandated.

Key Use Cases

Protecting highly sensitive communications (law firms, medical, financial) from mass surveillance.

Hardening network infrastructure against STARTTLS downgrade attacks.

Meeting modern rigorous compliance and security audit frameworks.

Advanced Details

Because MTA-STS can block inbound email entirely if a sender has severe TLS issues, it supports a "testing" mode to gather metrics securely before enforcing the plaintext block.

Cybersecurity Pros & Cons

Security Advantages
  • Directly defeats STARTTLS downgrade attacks where a MITM strips encryption and reads email in plaintext.
  • Policy is served over HTTPS with a valid certificate — attackers cannot silently tamper with it via DNS spoofing alone.
  • Testing mode allows risk-free deployment, collecting TLS-RPT failure data before enforcing email encryption.
  • MTA-STS + TLS-RPT together provide both enforcement and visibility — critical for compliance-driven environments.
Security Limitations
  • MTA-STS requires a functioning HTTPS server at mta-sts.domain.com — infrastructure failure silently disables the policy.
  • Policy caching (max_age) means revoked policies remain active for days after removal, delaying emergency policy changes.
  • Does not protect against compromised mail servers themselves — only encrypts the transport layer between MTAs.
  • Many smaller or legacy email providers do not support MTA-STS, causing legitimate mail to be blocked in enforce mode.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs