← All articles
Email Security 2026-02-23 · 5 min read

MTA-STS and TLS-RPT: Enforcing Encrypted Email Delivery

Email between servers uses STARTTLS to negotiate encryption — but by default that negotiation is opportunistic and can be silently stripped by an attacker in the middle, downgrading delivery to plaintext.

MTA-STS

Mail Transfer Agent Strict Transport Security lets a domain publish a policy (over HTTPS, referenced by a DNS TXT record) that tells senders: always use TLS with a valid certificate to deliver mail here, and refuse to fall back to plaintext. That closes the downgrade hole.

TLS-RPT

TLS Reporting asks sending servers to email you daily summaries of any TLS delivery failures, so you find out about problems instead of silently losing or downgrading mail.

Deploying

Publish an MTA-STS policy file, its _mta-sts TXT record, and a _smtp._tls TLS-RPT record. The MX analyser checks all three and flags what is missing.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Email Security SPF Records Explained: Stop Others Spoofing Your Email SPF tells the world which servers may send mail for your domain. Here is how to write one that actually protects you. Email Security DMARC: The Policy That Ties SPF and DKIM Together DMARC tells receivers what to do with mail that fails authentication — and reports who is sending as you. Here is how to roll it out. Email Security DKIM: How a Cryptographic Signature Proves Your Email Is Real DKIM adds a tamper-proof signature to your mail. Here is what it is and how to set it up correctly.