Guides Security

How Email Transport Security Works

How mail servers encrypt delivery between each other: STARTTLS and why it can be downgraded, what MTA-STS and TLS-RPT add, the exact DNS records and policy file, and how this differs from SPF, DKIM and DMARC.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Email travels from server to server over SMTP. Encryption between servers is separate from authenticating who sent a message (SPF, DKIM and DMARC, see How Email Authentication Works: SPF, DKIM and DMARC). STARTTLS upgrades a plain SMTP connection to TLS, but senders accept a failed upgrade silently, so an attacker can strip it. MTA-STS (RFC 8461) lets a domain say that its mail must be delivered over verified TLS. Build the records with the MTA-STS Policy Generator; the glossary entry is MTA-STS, and reply codes are in SMTP Reply Codes Cheat Sheet.

  • Port 25 server-to-server delivery starts in plain text; the sender asks for STARTTLS, and if the answer is missing or TLS fails, it usually delivers unencrypted anyway.
  • Certificates are often not checked, so even a successful upgrade may not stop a man in the middle.
  • Ports 465 (implicit TLS) and 587 (submission with STARTTLS) are for your own mail client, not for server-to-server delivery.

MTA-STS in three pieces

  • A DNS TXT record at _mta-sts.example.com signals that a policy exists: v=STSv1; id=20261028T000000Z. Change the id whenever the policy changes.
  • A policy file served over HTTPS at https://mta-sts.example.com/.well-known/mta-sts.txt:
version: STSv1
mode: enforce
mx: mail.example.com
mx: *.example.net
max_age: 604800
  • The policy lists the allowed MX hosts, the mode (testing, enforce or none) and how long senders may cache it (max_age, in seconds; 604800 is one week).

TLS-RPT: find out when it fails

A TLS-RPT record (RFC 8460) asks sending servers to report failures. Publish a TXT record at _smtp._tls.example.com: v=TLSRPTv1; rua=mailto:[email protected]. Daily JSON reports then show which senders could not negotiate TLS or validate your certificate.

Rolling it out

  • Start in testing mode with a short max_age and watch the TLS reports.
  • Make sure every MX host has a valid, unexpired certificate whose name matches the MX host name (see How to Check an SSL Certificate).
  • Move to enforce and raise max_age (a week, then months).
  • MTA-STS protects delivery to your domain only if senders support it; DANE (TLSA records with DNSSEC) is an alternative.

Try these tools

MTA-STS Policy Generator

Generate an MTA-STS policy file (mta-sts.txt), the _mta-sts DNS TXT record and the optional TLS-RPT reporting record.

SSL Certificate Checker

Check any domain's SSL/TLS certificate details server-side — issuer, subject, expiry date, and SAN list.

DNS Record Lookup

Look up A, AAAA, MX, TXT, NS, or CNAME DNS records for any domain in real time.

Email Header & Security Analyzer

Paste raw email headers to identify the true sender, understand routing hops, and analyze email security protocols like SPF, DKIM.

See also

  • Glossary MTA-STS
    MTA-STS is a standard (RFC 8461) that lets a domain require that other mail servers deliver its email over verified TLS encryption.
  • Glossary TLS
    TLS (Transport Layer Security) is the cryptographic protocol that encrypts and authenticates connections, including HTTPS, email and VPNs.
  • Glossary MX record
    An MX (mail exchanger) record is a DNS record that names the servers that accept email for a domain, with a priority number.
  • Glossary DMARC
    DMARC is a DNS policy that tells receivers what to do with email that fails SPF and DKIM alignment, and where to send reports about it.
  • Guide How Email Authentication Works: SPF, DKIM and DMARC
    What SPF, DKIM and DMARC each check, what their DNS records look like.
  • Cheat sheet SMTP Reply Codes Cheat Sheet
    Every standard SMTP reply code with its meaning, how the three digits are built.
  • Guide How HTTPS and TLS Work
    How the TLS 1.3 handshake, key exchange and certificate chain make a connection private and authenticated.

Frequently Asked Questions

Often, but not guaranteed. Servers usually try STARTTLS opportunistically and fall back to plain text if it fails, which an attacker on the path can force. MTA-STS tells senders to refuse that fallback.

Back to the guides
AdSense Placeholder
Slot: footer_leaderboard