MTA-STS and TLS-RPT
A policy that makes senders deliver to you only over verified encryption, plus reports when it fails.
Without MTA-STS, anyone on the network path can downgrade mail to you to unencrypted delivery. MTA-STS is a TXT record and a policy file at mta-sts.yourdomain listing your mail servers; TLS-RPT tells senders where to report failures. Start in testing mode, read the reports, then enforce.
Related terms
- DMARC: The policy that tells receivers what to do when mail fails SPF and DKIM, and where to report.
- SPF (Sender Policy Framework): A DNS record listing which servers may send email for your domain.
