What is MTA-STS?
Forces inbound mail to your domain over authenticated, encrypted TLS.
Written by the SkyQon engineering team · Last verified 4 August 2026
Why it matters
SMTP encryption is opportunistic by default: if TLS negotiation fails, mail is delivered in the clear rather than not at all. MTA-STS lets you declare that mail to your domain must travel over authenticated, validated TLS, closing that downgrade path to an attacker on the network.
The standard
RFC 8461 (2018). A DNS TXT record at _mta-sts.<domain> points to a policy file served over HTTPS at mta-sts.<domain>/.well-known/mta-sts.txt, which lists your MX hosts, a max age and a mode.
Official text: RFC 8461
How it fails
Most deployments never leave mode=testing, which reports but enforces nothing. The other common break is the policy file going dark (an expired certificate on the mta-sts host, a web-server migration), after which senders fall back to their cached copy until it ages out, then to no policy at all.
Related terms
Check this on your own domain
SkyQon reads the same public signals described on this page and scores them for your domain. No account, no agent, nothing to install — a scored report by email in minutes.