MTA-STS Enforces Authenticated TLS for SMTP Delivery

Wed, 23 Sep 2026 00:00:00 +0000

MTA-STS Enforces Authenticated TLS for SMTP Delivery

SMTP STARTTLS can encrypt mail transport, but ordinary opportunistic TLS permits delivery to continue when encryption is unavailable. That compatibility behavior leaves room for an active intermediary to suppress STARTTLS or redirect delivery toward an unintended server.

SMTP MTA Strict Transport Security, defined by RFC 8461, gives a recipient domain a policy channel for conforming sending MTAs. The policy states which MX hosts are acceptable and whether delivery must use TLS with a valid PKIX certificate. In enforce mode, a sender does not silently downgrade when those checks fail.

TLS-RPT Exposes SMTP TLS Failures as Aggregate Reports

Wed, 23 Sep 2026 00:00:00 +0000

SMTP transport security has an observability problem. A recipient domain can publish an MTA-STS policy or DANE TLSA records, yet many failures occur on remote sending systems: certificate validation can fail, an MX host can become unreachable, STARTTLS negotiation can break, or a published transport policy can be invalid. The recipient needs telemetry from those senders to distinguish a working deployment from a policy that silently blocks delivery.

SMTP TLS Reporting, commonly called TLS-RPT, defines that telemetry channel in RFC 8460. A recipient domain publishes a DNS TXT record that names one or more report destinations. Participating sending systems then produce aggregate reports describing successful policy-compliant TLS sessions and failures encountered while delivering mail to that domain.

MTA-STS on Nalar

MTA-STS Enforces Authenticated TLS for SMTP Delivery

MTA-STS Enforces Authenticated TLS for SMTP Delivery

TLS-RPT Exposes SMTP TLS Failures as Aggregate Reports