How does the "MTA-STS (email encrypted in transit)" check work?

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that enforces TLS encryption for inbound emails to your domain. Without MTA-STS, an attacker on the network path can force email servers to send messages in the clear (TLS downgrade attack). The _mta-sts TXT record publishes the policy and security policy URL.

Why does the "MTA-STS (email encrypted in transit)" check matter?

MTA-STS protects the privacy of inbound emails. Without it, malicious actors between two email servers can read messages in transit. While less well-known than SPF/DKIM/DMARC, it completes the email security stack and is recommended by modern RFCs.

Domain & DNS Check n°32 / 120

MTA-STS (email encrypted in transit)

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that enforces TLS encryption for inbound emails to your domain. Withou…

Analyse my site for free

← All checks

What is it?

Understanding "MTA-STS (email encrypted in transit)"

MTA-STS (Mail Transfer Agent Strict Transport Security) is the email equivalent of what HSTS does for the web: it forces sending servers to use an encrypted and verified TLS connection to deliver an email to your domain, and to refuse delivery if encryption fails or the certificate is invalid.

By default, the SMTP protocol (used to transport emails between servers) will silently "downgrade" to an unencrypted connection if TLS fails, to guarantee deliverability — a historically practical behaviour, but one that opens the door to interception attacks. MTA-STS removes this fallback net.

❌ Without MTA-STS

🕵️ Network attacker

→ forces a TLS downgrade →

✉️ Email intercepted in cleartext

✅ With MTA-STS

🕵️ Network attacker

→ downgrade refused (MTA-STS policy) →

🔒 Email not delivered rather than exposed

How we check it

How TheSiteFuse checks "MTA-STS (email encrypted in transit)"

TheSiteFuse queries the TXT record _mta-sts.<domain> and looks for a value containing v=STSv1. This check only verifies the existence of the DNS announcement record — full MTA-STS configuration also requires a policy file hosted at https://mta-sts.<domain>/.well-known/mta-sts.txt, which is not verified by this test. The absence of MTA-STS is classified as "info" rather than a blocking warning: it's an advanced hardening measure, not a baseline requirement.

Risks if it fails

Why "MTA-STS (email encrypted in transit)" matters

Email interception on untrusted networks — without MTA-STS, an attacker positioned to intercept traffic between two mail servers (an SMTP-level man-in-the-middle attack) can force an unencrypted connection and read email content in transit.
STARTTLS stripping attack — a documented technique involves removing the STARTTLS command from an SMTP negotiation to force plaintext delivery, without either sender or recipient necessarily noticing.
Confidentiality of business communications — for sectors handling sensitive data (legal, healthcare, finance), the lack of a guaranteed in-transit encryption for emails constitutes a compliance risk beyond the purely technical one.

How to fix

Fix "MTA-STS (email encrypted in transit)" step by step

Step 1 — Publish the DNS announcement record

Name: _mta-sts.yourdomain.com
Type: TXT
Value: v=STSv1; id=20260702120000

Step 2 — Host the policy file

Create a subdomain mta-sts.yourdomain.com pointing to a valid HTTPS server, serving the following file at the exact URL /.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: mail.yourdomain.com
max_age: 604800

Recommended gradual rollout: start with mode: testing to observe behaviour with no impact, then switch to mode: enforce once the configuration is validated. The id field of the TXT record must be incremented on every policy change to force sending servers to re-read it.

Learn more

Reference resource

To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.

Wikipedia — MTA-STS (email encrypted in transit)

Does your site pass this check?

Run the free full audit (120 checks) and instantly discover what needs fixing.

Previous BIMI record Next TLS-RPT (email TLS reports)