Glossary · Email & infrastructure
MTA-STS
MTA-STS (RFC 8461) lets a domain require TLS for all inbound email delivery, published and fetched over HTTPS rather than trusted opportunistically — closing the downgrade attack that plain SMTP TLS leaves open.
Standard SMTP transport encryption (STARTTLS) is opportunistic: a sending server offers TLS, but if the connection is intercepted and the offer is stripped, most servers silently fall back to sending the message in plaintext rather than refusing delivery. MTA-STS removes that fallback. A domain publishes a policy — enforced over HTTPS, not DNS alone, since DNS itself can be spoofed without DNSSEC — declaring that mail to it must use TLS with a valid certificate, and sending servers that support MTA-STS will refuse to deliver over a downgraded connection.
The policy is discovered via a well-known HTTPS URL plus a DNS TXT record that signals the policy exists and should be checked; the HTTPS fetch, not the DNS record itself, carries the enforceable policy content. This two-step design means an attacker who can only forge DNS cannot silently loosen the domain’s TLS requirement.
Ciphera Relay publishes MTA-STS alongside DKIM, SPF, and DMARC, so mail to a Relay-protected domain is both authenticated and required to travel encrypted end-to-end between mail servers.