MTA-STS

Mail Transfer Agent Strict Transport Security

In plain language

A published policy that tells other mail servers to only deliver to your domain over an encrypted connection.

The metaphor

Like telling the courier your parcels only travel in a locked van, and to turn back if one isn't available.

Going deeper

How it works

Your domain publishes a small DNS record and a policy file on a web address.
The policy names your mail servers and says encryption is required.
Sending servers that support it refuse to deliver over an unencrypted or redirected connection.
It usually starts in testing mode, then moves to enforce once reports look clean.

How WILDCARD handles it

Domain Security hosts and maintains the policy for you and keeps it in step with your mail servers.

In practice

An attacker on the network tries to strip encryption from mail heading to you.
You change email providers and the policy needs to list the new servers.
A scan shows the policy in testing mode, not enforce.

A question owners ask

Do I need this if I already have SPF, DKIM and DMARC? Those prove who sent a message. MTA-STS protects the message on its way to you. They work together.

Where WILDCARD handles this

Domain
Security

Email deliverability
Reputation monitoring
Management and renewals

Start with Domain Security Meet Domain Security →

Related terms

Used on

Could someone email your team as you?

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →