Glossary
MTA-STS
A mechanism by which a mail service publishes a policy declaring it can receive TLS-secured SMTP connections, so sending servers can refuse to deliver to MX hosts that do not present a trusted certificate.
In plain terms
A published promise that says 'always use TLS with us, and do not deliver if you cannot'.
Why it matters for deliverability
It closes the downgrade gap in opportunistic STARTTLS, where an attacker who can strip the TLS offer gets the mail delivered in plaintext instead.
What to do about it
- Publish in testing mode first and read the TLS-RPT reports.
- Make sure every MX host has a valid certificate matching its name before enforcing.
- Move to enforce mode only once reports are clean.
Source
RFC 8461 — SMTP MTA Strict Transport Security (MTA-STS)
“a mechanism enabling mail service providers (SPs) to declare their ability to receive Transport Layer Security (TLS) secure SMTP connections”
Checked 2026-08-29
Go deeper
Definitions reviewed 2026-08-29. Spotted something wrong? Tell us.
See how your own mail is handled
Run a real message through MailTester and read the authentication results, spam score and delivery signals described on this page against your own domain.