MTA-STS: closing the email interception gap with one file

Email was designed before anyone worried about interception. An attacker with network control can strip the STARTTLS advertisement and quietly downgrade a connection to plaintext. MTA-STS exists to close exactly that gap.

How MTA-STS works

Two moving parts:

1. A DNS TXT record at _mta-sts.yourdomain.com announcing that the domain speaks MTA-STS and which policy id is current.
2. A policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, served over HTTPS with a valid certificate.

_mta-sts.example.com. 300 IN TXT "v=STSv1; id=20250821T030000;"

version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
max_age: 604800

Start in testing mode: senders report failures but nothing is blocked. Move to enforce once reports are clean.

Why testing first matters

Turn on enforcement with a stale MX still listed and mail from partners is rejected outright. I have watched a client enforce before auditing DNS and lose two days of supplier email.

Lesson: MTA-STS only works when the MX list in the policy matches reality exactly — including the leftovers from an old provider.

Verify the setup

dig +short TXT _mta-sts.example.com
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
openssl s_client -connect mta-sts.example.com:443 -servername mta-sts.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

An expired certificate makes receivers treat the policy as unavailable and fall back to opportunistic TLS. Monitor this endpoint.

Pair it with TLS-RPT and DMARC

• TLS-RPT tells you which servers failed to negotiate TLS.
• DMARC handles domain spoofing, an entirely separate problem.
• MTA-STS + DANE gives two independent validations, but DANE requires DNSSEC.

Do all three and your domain joins the small group that genuinely resists email interception.