Tagged “mta-sts”

All Guides Product & news Forwarding & lists Fundamentals DMARC SPF DKIM BIMI Transport security Deliverability Threats & fraud Compliance & industries Provider setup Standards & RFCs How-to guides Troubleshooting

6 articles

30 May 2026 · 12 min read

Email transport security: STARTTLS, MTA-STS, DANE

DMARC proves who sent a message, but it does nothing to protect that message while it crosses the internet. Here is how opportunistic STARTTLS, MTA-STS, DANE and TLS-RPT work together to keep inbound mail encrypted in transit, why STARTTLS alone is trivially downgraded, and the safe order to deploy enforcement without bouncing legitimate mail.

12 May 2026 · 13 min read

DANE and TLSA records explained

DANE pins your mail server's certificate in DNSSEC-signed TLSA records so senders refuse to deliver over a downgraded or substituted TLS connection. Here is how TLSA records work, how DNSSEC anchors the trust, how DANE compares with MTA-STS, and which one fits your domain.

9 May 2026 · 12 min read

What is MTA-STS and how does it work?

MTA-STS forces encrypted, authenticated delivery of your inbound mail. Learn how the _mta-sts DNS record and the HTTPS-hosted policy file work together, the difference between testing and enforce mode, and exactly how it stops TLS downgrade and interception attacks.

7 May 2026 · 12 min read

What is TLS-RPT?

TLS-RPT (SMTP TLS Reporting) is a single safe-to-publish DNS record that gives you a daily, machine-readable summary of how other mail servers negotiated encryption with your inbound MX hosts. Learn what the record and its JSON reports contain, how to decode each failure type, and the exact publish-then-enforce workflow that pairs it with MTA-STS without risking an email outage.

30 March 2026 · 15 min read

MTA-STS vs DANE: which transport security to use

MTA-STS and DANE both stop SMTP downgrade attacks, but they anchor trust in opposite places: the web PKI versus DNSSEC. Here is how their trust models, failure behaviour and deployment burden differ, and a concrete guide to choosing one or running both.

23 March 2026 · 13 min read

RFC 8461: the MTA-STS standard explained

A precise walk through RFC 8461: why server-to-server mail needed MTA-STS, the _mta-sts DNS signal, the HTTPS-hosted policy file, the none, testing and enforce modes, and exactly how a sending MTA fetches and applies a policy.