MTA-STS

What this check looks at

Hardening group · check id mta_sts · all thirteen checks

“Forces inbound mail to arrive over TLS instead of silently downgrading to plain text.” - the wording shown beside this check while it runs.

Mail servers normally negotiate encryption optimistically: they try TLS, and if the other side says it cannot, they send in plain text anyway. MTA-STS - Mail Transfer Agent Strict Transport Security - publishes a policy saying "encryption is not optional for my domain", so a sending server refuses to fall back.

Why it matters

The optimistic default is trivially defeated. An attacker positioned on the network path only has to answer "I do not support TLS", and the message is handed over in plain text - readable and alterable - with no warning to anyone. MTA-STS closes that.

This protects mail arriving at you, which is the other half of the picture from SPF, DKIM and DMARC.

What each verdict means here

Pass

A policy is published and served.

Warn

Partially configured - typically the DNS record without the policy file, or a policy still in testing mode.

Not applicable

No policy. Common, and not counted against the score.

What to do

1. Publish the _mta-sts DNS record and host the policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Both halves are required.
2. Start the policy in testing mode, which reports problems without refusing mail.
3. Move to enforce only once your MX hosts and their certificates match the policy exactly - a mismatch in enforce mode rejects real mail.

What this check does not do

We check what is published. We do not fetch or validate the certificates on your mail servers.