{"id":28908,"date":"2024-11-29T12:49:11","date_gmt":"2024-11-29T12:49:11","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=28908"},"modified":"2026-05-18T14:49:06","modified_gmt":"2026-05-18T14:49:06","slug":"what-is-mta-sts-and-why-do-you-need-it","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/","title":{"rendered":"What Is MTA-STS: Why You Need It and How It Works"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">MTA-STS (Mail Transfer Agent Strict Transport Security) is a mechanism that enforces TLS encryption for inbound email delivery to a domain. It enables mail servers to securely communicate by ensuring messages are transmitted over an encrypted connection, thereby mitigating risks such as man-in-the-middle attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MTA-STS is defined in RFC 8461 MTA-STS and is supported by major email providers. It works alongside STARTTLS by enforcing encrypted delivery and preventing downgrade attacks. This policy complements and strengthens STARTTLS, which is a command that allows mail servers to upgrade an SMTP connection to a secure, encrypted one.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The issue with STARTTLS is that it is opportunistic by default. Without additional policy mechanisms, attackers may attempt downgrade attacks that force delivery over an unencrypted connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The MTA-STS policy helps prevent attackers from intercepting or redirecting email traffic. Unlike STARTTLS, MTA-STS tells compliant sending mail servers to deliver email to your domain only over TLS when a valid policy is in place.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-is-mta-sts-necessary-for-email-security\"><b>Is MTA-STS Necessary for Email Security?<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The MTA-STS DNS policy, coupled with TLS reports, is a reliable way to make your email communications more secure. Here is what the policy does:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Hinders downgrade attacks<\/li>\n\n\n\n<li>Reduces the risk of man-in-the-middle (MITM) attacks<\/li>\n\n\n\n<li>Helps identify certificate validation issues, including expired or untrusted TLS certificates<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">TLS-RPT, like DMARC reports, provides details on successes and failures, keeping you informed and ready to make fixes. Despite its benefits, MTA-STS adoption remains relatively limited, which increases the risk of misconfigured or unencrypted mail delivery across domains.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-importance-of-tls-reporting\"><b>The Importance of TLS Reporting<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">TLS Reporting (TLS-RPT) is a protocol that allows email domains to receive reports about the success or failure of TLS encryption during email transmission, providing insights into potential security issues when emails are sent to a domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Like <a href=\"https:\/\/easydmarc.com\/blog\/understanding-dmarc-reports\/\">DMARC reports<\/a>, TLS reports detail failed SMTP connections and explain why they happened. The failures commonly fall into categories such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Failed TLS negotiation<\/li>\n\n\n\n<li>DNS-related issues<\/li>\n\n\n\n<li>MTA-STS problems<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, TLS reports include a wider range of failure types defined in RFC 8460, such as certificate validation errors, handshake failures, or TLS not being available. Like DMARC reports, they are delivered to a specific URI (Uniform Resource Identifier) or email address configured via a <a href=\"https:\/\/easydmarc.com\/tools\/txt-record-lookup\">DNS TXT record<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Here is the DNS record string<\/strong>:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cv=TLSRPTv1; rua=mailto:tlsrpt@example.com,https:\/\/tlsrpt.example.com\/v1\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The string contains:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The TLS version (\u201cv=\u201d)<\/li>\n\n\n\n<li>The URI (Uniform Resource Identifier) that\u2019s going to receive the reports (\u201crua=\u201d). This line can take more than one value separated by a comma.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">The TLS Report Structure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Unlike DMARC XML reports, TLS Reporting is easy to read and understand. The report file is in JSON format.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"602\" height=\"847\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2022\/07\/Picture2.png\" alt=\"Components of TLS Report\" class=\"wp-image-43157\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2022\/07\/Picture2.png 602w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2022\/07\/Picture2-213x300.png 213w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The table below explains the components of a TLS Report shown in the image above.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td colspan=\"2\"><strong>Components of TLS Report<\/strong><\/td><\/tr><tr><td>organization-name<\/td><td>Name of the reporting party<\/td><\/tr><tr><td>date-range<\/td><td>Timeframe for the collected results containing the start and end dates as a subcategory<\/td><\/tr><tr><td>contact-info<\/td><td>Contact information<\/td><\/tr><tr><td>report-id<\/td><td>Unique report identifier<\/td><\/tr><tr><td>policies<\/td><td>This section contains information about the various active policies for the given domain (STARTTLS, DANE, DNSSEC, MTA-STS). In the case of MTA-STS, for example, this section will repeat the policy file string<\/td><\/tr><tr><td>summary<\/td><td>Provides the session count for successful and failed sessions<\/td><\/tr><tr><td>failure-details<\/td><td>Mentions what went wrong. The \u201cresult type\u201d can take one of the 10+ set values, depending on the failure\u2019s root cause. This line also includes information on the sending server, receiving IP, and its MX hostname<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-does-mta-sts-work\"><b>How Does MTA-STS Work?<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MTA-STS publishes a policy that compliant sending mail servers use to validate TLS when delivering email to your domain. It tells the sending SMTP server that communication with your email server must be encrypted, and the domain name in the TLS certificate and the policy must match. This helps ensure that all communication delivered to your inbox is encrypted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The policy contains a two-part mechanism: The MTA-STS file published on an HTTPS-enabled web server, and a DNS TXT record telling senders that your domain supports MTA-STS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once everything is set, you\u2019ll receive reports via TLS-RPT about failures and issues. Sending servers cache the MTA-STS file and use it repeatedly for a period indicated in the document. Upon expiration, the servers request the file again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s dive further into the two components of the MTA-STS policy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The MTA-STS Policy File<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The MTA-STS policy file is a TXT file served over HTTPS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"602\" height=\"223\" src=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2022\/07\/Picture3.png\" alt=\"Components of MTA-STS File \" class=\"wp-image-43160\" srcset=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2022\/07\/Picture3.png 602w, https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2022\/07\/Picture3-300x111.png 300w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The table below explains the components of an MTA-STS file shown in the image above.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>Components of MTA-STS File&nbsp;<\/strong><\/td><td><strong>Description<\/strong><\/td><td><strong>Options\/Details<\/strong><\/td><\/tr><tr><td>version<\/td><td>The version of the policy file you\u2019re viewing&nbsp;<\/td><td>The proper syntax is to include this line first, with the other components following in any order<\/td><\/tr><tr><td>mode<\/td><td>The policy mode<\/td><td>The policy mode can take either of the values below:<br \/><strong>testing: <\/strong>The messages that fail to pass the TLS won\u2019t be blocked, but you\u2019ll be able to gather data on them (similar to the DMARC quarantine policy). Enable TLS-RPT to start getting the reports.<br \/><br \/><strong>enforce:<\/strong> Failing the TLS means that the emails won\u2019t be delivered (similar to the DMARC reject policy). However, you\u2019ll still receive reports.<br \/><br \/><strong>none:<\/strong> While the modes above are somewhat comparable to DMARC policies, this one is very distinct. The \u2018none\u2019 policy in your MTA-STS file means fully disabling the policy.<\/td><\/tr><tr><td>mx<\/td><td>To fill in this part, you have to pull your MX records from the DNS<\/td><td>Mention each mail host on a separate line to nail the syntax of the file<\/td><\/tr><tr><td>max_age<\/td><td>Indicates how long the sender should cache the policy<\/td><td>The number is expressed in seconds and should be:<br \/><br \/>between 604,800 and 1,209,600 (1\u20132 weeks) for <strong>testing mode<\/strong><br \/><br \/>between 24 hours (86,400 seconds) and 31,557,600 (one year) for <strong>enforce mode<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-the-mta-sts-dns-record\"><b>The MTA-STS DNS Record<\/b><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400;\">For senders to \u201cknow\u201d you have implemented the MTA-STS policy, you have to set up a DNS record. It points to the policy file and contains the following components:<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><b>\u201cv=:\u201d<\/b><span style=\"font-weight: 400;\"> This is the policy version number.<\/span><\/li>\n\n\n\n<li><b>\u201cid=:\u201d<\/b><span style=\"font-weight: 400;\"> This is the policy identification number and should change once the policy is updated.<\/span><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-are-the-requirements-for-mta-sts\"><b>What are the Requirements for MTA-STS?<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400;\">Before starting the MTA-STS setup, you need to check specific requirements, as not every server can handle the MTA Strict Transport Security policy. These requirements are:<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><span style=\"font-weight: 400;\">Can accept mail transfers via TLS connection<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400;\">Uses at least TLS version 1.2<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400;\">The TLS certificates should:<\/span>\n<ul class=\"wp-block-list\">\n<li><span style=\"font-weight: 400;\">Be up-to-date<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400;\">Have the same servers mentioned in your <\/span><a href=\"https:\/\/easydmarc.com\/blog\/what-is-dns-mx-record-and-how-to-check-it\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">MX records<\/span><\/a><\/li>\n\n\n\n<li><span style=\"font-weight: 400;\">Be trusted by a root certificate authority<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-implement-your-mta-sts-policy\"><b>Implement Your MTA-STS Policy<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400;\">Setting up your MTA-STS DNS policy is relatively straightforward. But however imp<\/span>What Steps Are Involved in Setting Up MTA-STS?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019re wondering what steps are involved in setting up MTA-STS, the process typically includes preparing your domain, publishing a policy file, and configuring DNS records. Setting up your MTA-STS DNS policy is relatively straightforward, but moving from \u201ctesting\u201d to \u201cenforcing\u201d takes time and focus.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are the steps to take before creating the DNS record and the MTA-STS file itself:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>List all the domains and subdomains you plan to protect.<\/li>\n\n\n\n<li>Use a TLS checker to discover any issues with its configuration<\/li>\n\n\n\n<li>Use a <a href=\"https:\/\/easydmarc.com\/tools\/dns-record-checker\">DNS checker<\/a> to confirm the required DNS entries.<\/li>\n\n\n\n<li>Ensure that the certificates are up-to-date and TLS is on version 1.2 or higher.<\/li>\n\n\n\n<li>Make sure your server supports the Secure Socket Layer Certificate (SSL). HTTP won\u2019t be enough, you will need HTTPS.<\/li>\n\n\n\n<li>Use a holistic solution to ease your way into policy compliance.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">After these prerequisites are confirmed, begin the six-step implementation process:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1. Create the Policy in Testing Mode<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First of all, create the MTA-STS policy file. You can use an <a href=\"https:\/\/easydmarc.com\/tools\/mta-sts-generator\">MTA-STS generator<\/a> to speed up the initial setup. Follow the syntax above. Set the mode to \u201ctesting\u201d initially to see how the policy performs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2. Upload the TXT File to the WEB<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ensure the file is accessible on the WEB upon request so senders can find it once the DNS record points to it. The URL should follow this syntax:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/mta-sts.example.com\/.well-known\/mta-sts.txt\">https:\/\/mta-sts.example.com\/.well-known\/mta-sts.txt<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means that you should create a \u201c.well-known\u201d folder and put the document there.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3. Publish the DNS Record<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Publish the DNS record, verify it with an <a href=\"https:\/\/easydmarc.com\/tools\/mta-sts-check\">MTA-STS checker<\/a>, and move to the next phase, TLS configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4. Set up the TLS-RPT<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Create the DNS TLS entry as mentioned above and start receiving the reports. Don\u2019t forget that this is an MTA-STS test. Once you see everything working correctly, you can move to the next step.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5. Change the Mode to \u201cEnforce\u201d<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After this initial MTA-STS test, if everything runs smoothly, you can set the \u201cmode\u201d in the MTA-STS file to \u201cenforce.\u201d This will filter unencrypted emails.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6. Update the Version ID in Your DNS Record<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As the last step, don\u2019t forget to update the DNS with the new version ID.<br \/>EasyDMARC\u2019s <a href=\"https:\/\/easydmarc.com\/tools\/managed-mta-sts\">managed MTA-STS tool<\/a> helps simplify policy setup and ongoing management.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-why-mta-sts-matters-for-email-security\"><b>Why MTA-STS Matters for Email Security<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In simple terms, what is MTA-STS? It is a way to strengthen your email security by ensuring encrypted communication and protecting against <a href=\"https:\/\/easydmarc.com\/blog\/what-is-a-mitm-man-in-the-middle-attack\/\">man-in-the-middle attacks<\/a>. Combining the MTA-STS policy with TLS Reporting gives you valuable insights into potential issues while reducing the risk of downgraded, intercepted, or unauthenticated SMTP transport. Although setting up MTA-STS requires careful planning and testing, the long-term benefits, including enhanced security, better compliance, and reduced vulnerabilities, make it a vital tool for any organization. Start with testing mode, address any configuration issues, and gradually move to enforcement to secure your email ecosystem effectively. You can explore more detailed setup and troubleshooting guides in our relevant blogs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>MTA-STS (Mail Transfer Agent Strict Transport Security) is &#8230;<\/p>\n","protected":false},"author":1,"featured_media":61805,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[204,203],"tags":[],"class_list":["post-28908","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-email-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.6.1 (Yoast SEO v27.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>What Is MTA-STS? Email Security Setup Guide | EasyDMARC<\/title>\n<meta name=\"description\" content=\"Learn what MTA-STS is, how it enforces TLS for inbound email, why TLS reporting matters, and how to set up a secure MTA-STS policy for your domain safely.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is MTA-STS: Why You Need It and How It Works\" \/>\n<meta property=\"og:description\" content=\"Learn what MTA-STS is, how it enforces TLS for inbound email, why TLS reporting matters, and how to set up a secure MTA-STS policy for your domain safely.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/\" \/>\n<meta property=\"og:site_name\" content=\"EasyDMARC\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/EasyDMARC\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-29T12:49:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-18T14:49:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1400\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"EasyDMARC\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@easydmarc\" \/>\n<meta name=\"twitter:site\" content=\"@easydmarc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"EasyDMARC\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/\"},\"author\":{\"name\":\"EasyDMARC\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#\\\/schema\\\/person\\\/449261e9810b270cc697c7c9c5b89e97\"},\"headline\":\"What Is MTA-STS: Why You Need It and How It Works\",\"datePublished\":\"2024-11-29T12:49:11+00:00\",\"dateModified\":\"2026-05-18T14:49:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/\"},\"wordCount\":1590,\"publisher\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/What-is-MTA-STS.png\",\"articleSection\":[\"Blog\",\"Email Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/\",\"name\":\"What Is MTA-STS? Email Security Setup Guide | EasyDMARC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/What-is-MTA-STS.png\",\"datePublished\":\"2024-11-29T12:49:11+00:00\",\"dateModified\":\"2026-05-18T14:49:06+00:00\",\"description\":\"Learn what MTA-STS is, how it enforces TLS for inbound email, why TLS reporting matters, and how to set up a secure MTA-STS policy for your domain safely.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#primaryimage\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/What-is-MTA-STS.png\",\"contentUrl\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/What-is-MTA-STS.png\",\"width\":1400,\"height\":900,\"caption\":\"What is MTA-STS?\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/what-is-mta-sts-and-why-do-you-need-it\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/easydmarc.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/category\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Email Security\",\"item\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/category\\\/blog\\\/email-security\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"What Is MTA-STS: Why You Need It and How It Works\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/\",\"name\":\"EasyDMARC\",\"description\":\"Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/#organization\",\"name\":\"EasyDMARC\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/easydmarc.com\\\/img\\\/logo.png\"},\"image\":{\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/EasyDMARC\\\/\",\"https:\\\/\\\/x.com\\\/easydmarc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/easydmarc\\\/mycompany\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/#\\\/schema\\\/person\\\/449261e9810b270cc697c7c9c5b89e97\",\"name\":\"EasyDMARC\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fcbf1ca829f8e0977fce524da20caa8a528368d0909ce48741526046e5113259?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fcbf1ca829f8e0977fce524da20caa8a528368d0909ce48741526046e5113259?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fcbf1ca829f8e0977fce524da20caa8a528368d0909ce48741526046e5113259?s=96&r=g\",\"caption\":\"EasyDMARC\"},\"url\":\"https:\\\/\\\/easydmarc.com\\\/blog\\\/author\\\/easydmarc\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What Is MTA-STS? Email Security Setup Guide | EasyDMARC","description":"Learn what MTA-STS is, how it enforces TLS for inbound email, why TLS reporting matters, and how to set up a secure MTA-STS policy for your domain safely.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/","og_locale":"en_US","og_type":"article","og_title":"What Is MTA-STS: Why You Need It and How It Works","og_description":"Learn what MTA-STS is, how it enforces TLS for inbound email, why TLS reporting matters, and how to set up a secure MTA-STS policy for your domain safely.","og_url":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/","og_site_name":"EasyDMARC","article_publisher":"https:\/\/www.facebook.com\/EasyDMARC\/","article_published_time":"2024-11-29T12:49:11+00:00","article_modified_time":"2026-05-18T14:49:06+00:00","og_image":[{"width":1400,"height":900,"url":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png","type":"image\/png"}],"author":"EasyDMARC","twitter_card":"summary_large_image","twitter_creator":"@easydmarc","twitter_site":"@easydmarc","twitter_misc":{"Written by":"EasyDMARC","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#article","isPartOf":{"@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/"},"author":{"name":"EasyDMARC","@id":"https:\/\/easydmarc.com\/blog\/#\/schema\/person\/449261e9810b270cc697c7c9c5b89e97"},"headline":"What Is MTA-STS: Why You Need It and How It Works","datePublished":"2024-11-29T12:49:11+00:00","dateModified":"2026-05-18T14:49:06+00:00","mainEntityOfPage":{"@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/"},"wordCount":1590,"publisher":{"@id":"https:\/\/easydmarc.com\/blog\/#organization"},"image":{"@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#primaryimage"},"thumbnailUrl":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png","articleSection":["Blog","Email Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/","url":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/","name":"What Is MTA-STS? Email Security Setup Guide | EasyDMARC","isPartOf":{"@id":"https:\/\/easydmarc.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#primaryimage"},"image":{"@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#primaryimage"},"thumbnailUrl":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png","datePublished":"2024-11-29T12:49:11+00:00","dateModified":"2026-05-18T14:49:06+00:00","description":"Learn what MTA-STS is, how it enforces TLS for inbound email, why TLS reporting matters, and how to set up a secure MTA-STS policy for your domain safely.","breadcrumb":{"@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#primaryimage","url":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png","contentUrl":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png","width":1400,"height":900,"caption":"What is MTA-STS?"},{"@type":"BreadcrumbList","@id":"https:\/\/easydmarc.com\/blog\/what-is-mta-sts-and-why-do-you-need-it\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/easydmarc.com\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/easydmarc.com\/blog\/category\/blog\/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https:\/\/easydmarc.com\/blog\/category\/blog\/email-security\/"},{"@type":"ListItem","position":4,"name":"What Is MTA-STS: Why You Need It and How It Works"}]},{"@type":"WebSite","@id":"https:\/\/easydmarc.com\/blog\/#website","url":"https:\/\/easydmarc.com\/blog\/","name":"EasyDMARC","description":"Blog","publisher":{"@id":"https:\/\/easydmarc.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/easydmarc.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/easydmarc.com\/#organization","name":"EasyDMARC","url":"https:\/\/easydmarc.com\/","logo":{"@type":"ImageObject","url":"https:\/\/easydmarc.com\/img\/logo.png"},"image":{"@id":"https:\/\/easydmarc.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/EasyDMARC\/","https:\/\/x.com\/easydmarc","https:\/\/www.linkedin.com\/company\/easydmarc\/mycompany\/"]},{"@type":"Person","@id":"https:\/\/easydmarc.com\/blog\/#\/schema\/person\/449261e9810b270cc697c7c9c5b89e97","name":"EasyDMARC","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fcbf1ca829f8e0977fce524da20caa8a528368d0909ce48741526046e5113259?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fcbf1ca829f8e0977fce524da20caa8a528368d0909ce48741526046e5113259?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fcbf1ca829f8e0977fce524da20caa8a528368d0909ce48741526046e5113259?s=96&r=g","caption":"EasyDMARC"},"url":"https:\/\/easydmarc.com\/blog\/author\/easydmarc\/"}]}},"jetpack_featured_media_url":"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2024\/11\/What-is-MTA-STS.png","_links":{"self":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts\/28908","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/comments?post=28908"}],"version-history":[{"count":6,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts\/28908\/revisions"}],"predecessor-version":[{"id":61806,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/posts\/28908\/revisions\/61806"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/media\/61805"}],"wp:attachment":[{"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/media?parent=28908"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/categories?post=28908"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/easydmarc.com\/blog\/wp-json\/wp\/v2\/tags?post=28908"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}