---
title: "MTA-STS"
description: "MTA-STS is a standard that enforces encrypted TLS connections between mail servers, protecting against downgrade attacks. Learn its policy and DNS records."
url: "https://nodea.io/en/glossary/mta-sts"
lang: "en"
updated: "2026-07-13"
---

# MTA-STS

> MTA-STS is an email security standard that enforces encrypted TLS connections between mail servers and protects against attacks that downgrade encryption.

**MTA-STS** (Mail Transfer Agent Strict Transport Security) is an email security standard that lets a domain declare that inbound mail must be delivered only over an encrypted [TLS](https://nodea.io/en/glossary/tls) connection. It addresses a weakness of classic [SMTP](https://nodea.io/en/glossary/smtp), in which encryption is opportunistic and vulnerable to being forcibly downgraded to plaintext transmission.

## How MTA-STS works

The domain owner publishes a security policy available over HTTPS plus a DNS record that signals it. Before sending a message, the sending server checks that policy and enforces its requirements. The mechanism consists of:

- **A DNS TXT record** — under the name *\_mta-sts*, it announces the existence of a policy and its version (an identifier), signalling to sending servers that the domain supports MTA-STS.
- **A policy file** — served over HTTPS at *mta-sts.domain*, it lists the required MX servers, the enforcement mode and a validity period.
- **Operating modes** — *testing* (report without blocking), *enforce* (refuse delivery without valid TLS) and *none* (disabled).
- **Policy caching** — the sending server keeps the fetched policy for its declared validity period, so changing the identifier in the TXT record forces a refresh.

## MTA-STS in practice

MTA-STS is deployed as part of hardening corporate email security:

1. **Protection against downgrade attacks** — it prevents an attacker from forcing mail to be sent unencrypted.
2. **Preventing MX spoofing** — the policy specifies which servers may receive the domain's mail.
3. **Complementing DMARC and reporting** — it works alongside [DMARC](https://nodea.io/en/glossary/dmarc), and together with [TLS-RPT](https://nodea.io/en/glossary/tls-rpt) provides reports on encryption problems.

Correctly deploying MTA-STS requires control over the domain's DNS records and hosting able to serve a dedicated subdomain with an HTTPS certificate for the policy file.

### What does MTA-STS protect against?

By default SMTP negotiates encryption opportunistically, so an on-path attacker can strip the TLS offer and force servers to send mail in plaintext (a downgrade attack). MTA-STS publishes a policy stating that a domain requires TLS, so the sending server refuses to deliver over an unencrypted connection.

## Related

- [TLS](https://nodea.io/en/glossary/tls)
- [SMTP](https://nodea.io/en/glossary/smtp)
- [DMARC](https://nodea.io/en/glossary/dmarc)
- [TLS-RPT](https://nodea.io/en/glossary/tls-rpt)
- [TXT Record](https://nodea.io/en/glossary/txt-record)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/mta-sts.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)