# What Is MTA-STS? How It Works & How to Set Up

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "WebPage",
  "headline": "What Is MTA-STS & How to Set It up for Your Domain\n",
  "description": "Learn what MTA-STS is, its key advantages and components, along with how it works and how you can set it up for your own domain. \n",
  "image": "https://res.cloudinary.com/mailmodo/image/upload/v1724991862/strapi/What_is_MTA_STS_and_How_You_Can_Set_it_Up_21b7f0f1e9.png",
  "datePublished": "2024-08-30T02:25:12.843Z",
  "dateModified": "2025-01-08T06:27:06.350Z",
  "publisher": {
    "@type": "Organization",
    "name": "Mailmodo",
    "url": "https://www.mailmodo.com/",
    "sameAs": [
      "https://www.linkedin.com/company/mailmodo/",
      "https://www.facebook.com/mailmodo/",
      "https://www.instagram.com/mailmodohq/",
      "https://www.youtube.com/@mailmodo"
    ],
    "logo": "https://www.mailmodo.com/static/images/logo/logo-full.svg",
    "description": "Mailmodo is a complete email marketing platform that helps email marketers to create and send interactive emails to drive growth and engagement.",
    "address": {
      "@type": "PostalAddress",
      "addressLocality": "Lewes",
      "addressRegion": "DE",
      "postalCode": "19958",
      "streetAddress": "Mailmodo Technologies Inc. 16192, Coastal Highway",
      "addressCountry": {
        "@type": "Country",
        "name": "US"
      }
    },
    "contactPoint": {
      "@type": "ContactPoint",
      "email": "enquiries@mailmodo.com",
      "contactType": "customer service"
    }
  }
}
</script>

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "What Is MTA-STS & How to Set It up for Your Domain\n",
  "description": "Learn what MTA-STS is, its key advantages and components, along with how it works and how you can set it up for your own domain. \n",
  "image": "https://res.cloudinary.com/mailmodo/image/upload/v1724991862/strapi/What_is_MTA_STS_and_How_You_Can_Set_it_Up_21b7f0f1e9.png",
  "datePublished": "2024-08-30T02:25:12.843Z",
  "dateModified": "2025-01-08T06:27:06.350Z",
  "author": {
    "@type": "Person",
    "name": "Anjali Nair",
    "url": "https://www.mailmodo.com/guides/author/anjali-nair/"
  },
  "publisher": {
    "@type": "Organization",
    "name": "Mailmodo",
    "logo": {
      "@type": "ImageObject",
      "url": "https://www.mailmodo.com/static/images/logo/logo-full.svg"
    }
  },
  "mainEntityOfPage": {
    "@type": "WebPage",
    "@id": "https://www.mailmodo.com/guides/mta-sts/"
  }
}
</script>

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "@id": "#creator",
  "description": "Email marketing software to create and send interactive emails to maximize conversions and reinvent your user journey",
  "email": "support@mailmodo.com",
  "image": "https://www.mailmodo.com/static/images/og-image.png",
  "knowsAbout": "Email marketing",
  "legalName": "Mailmodo Technologies Inc.",
  "location": "United States",
  "logo": "https://www.mailmodo.com/static/images/logo/logo-full.svg",
  "name": "Mailmodo",
  "sameAs": [
    "https://twitter.com/mailmodo",
    "https://www.facebook.com/company/mailmodo/",
    "https://www.linkedin.com/company/mailmodo/"
  ],
  "url": "https://www.mailmodo.com/"
}
</script>

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Home",
      "item": "https://www.mailmodo.com/"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "Guides",
      "item": "https://www.mailmodo.com/guides/"
    },
    {
      "@type": "ListItem",
      "position": 3,
      "name": "mta sts",
      "item": "https://www.mailmodo.com/guides/mta-sts/"
    }
  ]
}
</script>

## Table of contents

- What is MTA-STS?
- Advantages of MTA-STS
- Key components of MTA-STS policy
- How does MTA-STS work?
- How to set up MTA-STS for your domain
- Conclusion

A whopping [94%](https://www.egress.com/blog/company-news/stats-from-the-email-security-risk-report) of organizations report facing incidents related to email security. While emails are still the backbone of today’s digital world, they are also vulnerable to sophisticated cyber threats. This is why it is essential to set up an effective email infrastructure consisting of various security protocols to counter these threats. You might have already heard about SMTP, DMARC, and DKIM. **MTA-STS** is another email security protocol that is designed to prevent issues such as man-in-the-middle (MITM) attacks and address longstanding vulnerabilities in email transmission.

  

This guide will help you understand what **MTA-STS**, is, its key benefits, how it works, and how you can set it up for your domain.

## What is MTA-STS?

**MTA-STS (Mail Transfer Agent  - Strict Transport Security) is a security protocol that ensures that emails are sent over an encrypted [SMTP](https://www.mailmodo.com/guides/smtp/) connection.** This is done by enforcing the use of transport layer security (TLS) by email servers. Therefore, MTA-STS prevents unauthorized access to your emails which is a common threat for unsecured SMTP networks.

  

MTA-STS was developed to ensure that TLS was always used. Earlier, TLS attempted to encrypt the email only if both the sending and receiving servers supported it. If either of these servers did not support TLS, the email would be sent as a plain text file, making it vulnerable to potential attacks. With MTA-STS, servers can refuse to deliver the message to non-compliant servers, resulting in the email being bounced.

  

  

## Advantages of MTA-STS

Implementing an MTA-STS policy offers some crucial benefits for your domain. Take a look at the following key benefits it offers.

  

-   **Secure transmission:** MTA-STS ensures that your emails are encrypted while being sent. If the encryption cannot happen due to the lack of compliance on the receiving server, the email bounces without being intercepted.
-   **Protection against downgrade attacks:** A downgrade attack is a cyber attack that forces a system to adopt a weaker security protocol, which can increase the vulnerability of your server. MTA-STS ensures that only strong, encrypted connections are used.
-   **Smooth operation:** After the initial set-up process, MTA-STS operates automatically and requires minimal maintenance while providing a strong layer of security for all your inbound emails.
-   **Reliable communication:** Since MTA-STS requires mandatory TLS certificates, it ensures that you are only communicating with legitimate sources. This reduces your vulnerability to [phishing](https://www.mailmodo.com/guides/phishing-email/) and [spoofing](https://www.mailmodo.com/guides/email-spoofing/) attacks.

  

## Key components of MTA-STS policy

Before we understand how MTA-STS actually works, let’s learn more about the policy. Here is an example of an MTA-STS file, which is a TXT file.

  

```

version: STSv1

mode: enforce

max_age: 604800

mx: mail1.example.com

mx: mail2.example.com

mx: *.backup-mx.example.com

```

  

You can see the following key components in the above example.

  

 -   **Version**: This field specifies the version of MTA-STS that is being used, such as “STSv1”.
 -   **Mode**: This field indicates how the policy should be applied. There are three possible modes:
	 - **None**: The policy is published but not enforced.
	 - **Testing**: The policy is checked but not enforced. If there are TLS failures in this mode, they are reported, but emails will still get delivered.
	 - **Enforce**: The policy is strictly applied.
 -   **Max_age**: This field specifies how long the policy should be cached by sending mail server. This is usually indicated in seconds. Typically, this is set between one day (86400 seconds) and two weeks (1209600 seconds).
 -   **MX**: This field lists the recipient’s mail exchange servers that support MTA-STS. Multiple MX fields can be specified in the policy and each MX entry should be its own line in the policy file.

## How does MTA-STS work?



  

MTA-STS operates through the following key steps when a sender initiates the process of sending an email:

![How does MTA-STS work_.png](https://res.cloudinary.com/mailmodo/image/upload/f_auto,q_100/v1724991910/strapi/How_does_MTA_STS_work_9fd325ad5e.png)

### 1.  Policy discovery

The sending MTA performs a [DNS lookup](https://www.mailmodo.com/guides/dns-lookup/), i.e., it checks the receiving domain’s [DNS records](https://www.mailmodo.com/guides/dns-record/) to check if the domain has an MTA-STS policy. The policy is published as a TXT record in the domain's DNS zone under the name _mta-sts.`<domain>`. This TXT record contains a pointer to the HTTPS location where the actual MTA-STS policy is hosted.

  

### 2.  Policy retrieval

The sending MTA retrieves the policy file from the specified HTTPS endpoint. The policy file is then parsed by the sending server to check the requirements outlined by the policy.

### 3.  TLS enforcement

This is the step where the rules in the MTA-STS policy are enforced, given that the policy is in the “enforce” mode. The following aspects are verified in this step for the email to be delivered successfully:

1.  Ensuring that the connection is encrypted with TLS
2.  Validating the receiving server’s TLS certificate against policy requirements
3.  Confirming that the receiving server is on the approved MX host list

If any of these criteria are not met, then the email will not be delivered, and the sender will be notified that it has bounced.

  

### 4.  Policy validation

The MTA periodically checks if the MTA-STS policy is up-to-date. If the max_age period of the policy has expired, the sending server re-fetches the policy to ensure it has the latest version. The process also happens with each new email domain that the sending server interacts with. This helps maintain ongoing security and adapt to any changes in the recipient domain's security posture.

  

## How to set up MTA-STS for your domain



  

MTA-STS can be set up on any web server that supports HTTPS and meets the following criteria:

  

-   The server uses a TLS connection for transmitting emails
-   It uses a TLS version 1.2 or higher
-   It has valid TLS certificates that match the domain name used by the server in your [MX records](https://www.mailmodo.com/guides/mx-record/)

  

If you do not meet these requirements, it can lead to MTA-STS failures and emails getting bounced.

  

You can set up MTA-STS for your domain through the following key steps.

  ![How to set up MTA-STS for your domain.png](https://res.cloudinary.com/mailmodo/image/upload/f_auto,q_100/v1724991910/strapi/How_to_set_up_MTA_STS_for_your_domain_3143e78b26.png)

### Step 1: Create the MTA-STS policy file

This step involves drafting your MTA-STS policy. Here, you create a text file with all the key components required for the policy.

### Step 2: Publish the policy via DNS

You must then add the necessary DNS TXT record so that sending MTAs can discover and retrieve your policy.

### Step 3: Test the policy

You can use online MTA-STS validators or send test emails to ensure that the policy is functioning correctly. Before starting the testing, make sure to set the mode to “testing” so that your email delivery is not affected during the testing phase.

### Step 4: Monitor and update the policy

Once you have ensured that your policy works correctly, you can switch to the “enforce” mode. You must then regularly review and update your policy as needed, especially if you are facing delivery issues. At this stage, you may also set up TLS reporting if you wish to receive reports about policy failures.

  

  

If you are using Google Workspace to set up MTA-STS, you can check out this detailed walkthrough.

  

<lite-youtube videoid="OJJoFTSkkwQ"></lite-youtube>

## Conclusion

As the adoption of MTA-STS grows, it promises to make email communication more secure and resistant to common attacks. However, it must be noted that MTA-STS is only a part of the larger email security puzzle. Other email security protocols such as [DKIM](https://www.mailmodo.com/guides/dmarc/), [SPF](https://www.mailmodo.com/guides/spf/), and [DMARC](https://www.mailmodo.com/guides/dmarc/) are also vital to ensure a safer email ecosystem for everyone.

  

Overall, MTA-STS is a worthwhile investment for any organization prioritizing email security. You can also check out our detailed guide about [email security](https://www.mailmodo.com/guides/email-security/) to get a better understanding on how to better secure your email communications.

  

  

  

  
.

## Frequently Asked Questions

### Is MTA-STS compatible with all servers?


MTA-STS is compatible with most email servers. However, some older or less common servers might not recognize MTA-STS policies, which can lead to email delivery issues.


### What is the difference between MTA-STS and DANE?


Both MTA-STS and DANE are email security protocols. However, while DANE (DNS-based Authentication of Named Entities) relies on DNSSEC (DNS Security Extensions) to secure DNS records, MTA-STS does not require DNSSEC. This makes MTA-STS easier to implement and more widely supported.


### Can MTA-STS prevent all email-based attacks?


MTA-STS significantly reduces the risk of certain attacks such as MITM and downgrade attacks but it does not guarantee protection against all email threats such as phishing or spam. MTA-STS should be a part of a larger email security strategy.


### Is MTA-STS mandatory?


No, MTA-STS is not mandatory. However, it is recommended that you set it up on your domain to protect you against MITM and downgrade attacks.


### Are there any disadvantages to MTA-STS?


While MTA-STS offers significant security benefits, there might be some challenges that you need to keep in mind. These include the complexity of the setup process, reliance on DNS and HTTPS and the lack of universal compatibility.


<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "Is MTA-STS compatible with all servers?\n",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MTA-STS is compatible with most email servers. However, some older or less common servers might not recognize MTA-STS policies, which can lead to email delivery issues.\n"
      }
    },
    {
      "@type": "Question",
      "name": "What is the difference between MTA-STS and DANE?\n",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Both MTA-STS and DANE are email security protocols. However, while DANE (DNS-based Authentication of Named Entities) relies on DNSSEC (DNS Security Extensions) to secure DNS records, MTA-STS does not require DNSSEC. This makes MTA-STS easier to implement and more widely supported.\n"
      }
    },
    {
      "@type": "Question",
      "name": "Can MTA-STS prevent all email-based attacks?\n",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MTA-STS significantly reduces the risk of certain attacks such as MITM and downgrade attacks but it does not guarantee protection against all email threats such as phishing or spam. MTA-STS should be a part of a larger email security strategy.\n"
      }
    },
    {
      "@type": "Question",
      "name": "Is MTA-STS mandatory?\n",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, MTA-STS is not mandatory. However, it is recommended that you set it up on your domain to protect you against MITM and downgrade attacks.\n"
      }
    },
    {
      "@type": "Question",
      "name": "Are there any disadvantages to MTA-STS?\n",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "While MTA-STS offers significant security benefits, there might be some challenges that you need to keep in mind. These include the complexity of the setup process, reliance on DNS and HTTPS and the lack of universal compatibility.\n"
      }
    }
  ]
}
</script>

---

**Author: Anjali Nair**

Anjali Nair is a freelance writer fond of exploring various fields and genres with her pen. Primarily an academic and fiction writer, she also has experience in corporate copywriting.

