MTA-STS check (inbound TLS enforcement)
MTA-STS tells sending servers to use secure TLS when delivering email to your domain and helps reduce downgrade attacks.
- This matters more for inbound mail security and transport trust than for basic inbox placement.
- The full audit is useful when you want hardening guidance alongside SPF, DKIM and DMARC basics.
MTA-STS is a hardening topic, so this page stays explanatory. The live scan remains on the homepage with the rest of the checks.
What the report clarifies
MTA-STS pages tend to underperform because visitors are not always sure whether this is urgent, optional or purely technical.
Putting the real output in front of them helps: they can see that MTA-STS is framed as hardening, understand the expected artifacts and decide whether the full audit is worth it.
What you need for MTA-STS
TXT policy id
Publish _mta-sts TXT with v=STSv1; id=....
HTTPS policy file
Host /.well-known/mta-sts.txt at mta-sts.yourdomain.
Valid certificate
The policy endpoint must serve HTTPS with a trusted certificate.
Complementary controls
Use SPF, DKIM and DMARC alongside MTA-STS for full protection.
Typical rollout pitfalls
TXT record exists, policy file missing
The DNS part is visible, but the HTTPS policy endpoint is still incomplete or unreachable.
Policy file exists, versioning forgotten
If you change policy without updating the id= value, remote senders may keep stale expectations.
Certificate problems on the policy host
A weak or broken HTTPS setup undermines the very trust layer MTA-STS is supposed to provide.
Prioritizing it too early
Hardening is valuable, but not if SPF, DKIM or DMARC are still visibly broken.
When to prioritize MTA-STS
If your core authentication is broken, fix SPF, DKIM and DMARC first. If your basics are stable and you want stronger inbound transport guarantees, MTA-STS becomes the next sensible layer.
Practical rule of thumb
If your team is still debating who is allowed to send mail for the domain, MTA-STS is probably not the next bottleneck. If outbound identity is already under control and you want fewer blind spots in inbound transport, it starts to make more operational sense.
What to look for
The main question is priority: whether transport hardening should happen now, or after the authentication basics are stabilized.