MTA-STS (SMTP MTA Strict Transport Security) lets a domain publish a policy requiring that mail delivered to it travel over an encrypted connection to a correctly certified server, so a network attacker cannot quietly downgrade the connection to plaintext.
The problem it solves
Mail servers encrypt connections to each other opportunistically: if the receiving server offers TLS, the sender uses it; if not, or if something in the middle strips the offer, the sender carries on in plaintext. An attacker positioned on the network can exploit that without either side noticing.
How it works
The domain publishes a small TXT record at _mta-sts.yourdomain announcing a policy, and serves the policy itself over HTTPS at https://mta-sts.yourdomain/.well-known/mta-sts.txt. The policy lists the domain's legitimate mail hosts and a mode. A sending server that supports MTA-STS fetches it and, in enforce mode, refuses to deliver unless it can make a TLS connection with a valid certificate to one of the listed hosts. The standard is RFC 8461.
testing— report problems but still deliver.enforce— do not deliver over a connection that fails the policy.none— withdraw a previous policy.
Its companion, TLS reporting (TLS-RPT), is a TXT record at _smtp._tls.yourdomain naming an address for reports about failed connections — so you find out when something breaks, rather than guessing.
How to check a domain
curl https://mta-sts.yourdomain.com/.well-known/mta-sts.txtMTA-STS at Mailotte
mailotte.com publishes an MTA-STS policy in enforce mode listing both of its mail hosts, and a TLS-RPT record. You can read the policy yourself at https://mta-sts.mailotte.com/.well-known/mta-sts.txt. More on how the rest of the service is secured is on the security page.
Questions
Is MTA-STS the same as end-to-end encryption?
No. It protects mail while it travels between servers. The servers at each end can still read it.
Should I start in enforce mode?
Start in testing mode with TLS reporting on, confirm nothing fails, then switch to enforce.
Does every sending server support MTA-STS?
No — it only protects mail sent by servers that implement it. Mail from a server that does not is delivered as it would have been without the policy.