MTA-STS not configured

Check id: mta_sts.missing · fix effort: medium

What it means

Mail sent to you can be silently downgraded to an unencrypted connection by an attacker sitting in the network path. MTA-STS closes that gap.

The technical detail

Without MTA-STS (RFC 8461), SMTP TLS is opportunistic and STARTTLS can be stripped in transit.

How to fix it

1. Publish _mta-sts.<domain> TXT: v=STSv1; id=<timestamp>.
2. Serve the policy at https://mta-sts.<domain>/.well-known/mta-sts.txt (mode: testing first).
3. Add TLS-RPT to see delivery failures, then switch to mode: enforce.