SMTP started life in 1982 as a plaintext protocol. Forty years later, most mail is still carried by it — with TLS bolted on as an afterthought called STARTTLS.
STARTTLS is opportunistic: the client asks, the server agrees, and if a middlebox or attacker silently removes the "STARTTLS" advertisement from the server's banner, both sides happily continue in plaintext. That's a downgrade attack, and it's the reason your bank's email could theoretically cross the internet unencrypted without anyone's software complaining.
Two complementary standards close this hole: MTA-STS (RFC 8461) and DANE (RFC 7672). The MTA-STS & TLS-RPT and DANE/TLSA tools in yas.sh check both sides of the equation.
MTA-STS: HTTPS-published policy
MTA-STS tells other mail servers: "when you connect to my MX hosts, TLS is not optional." It has two parts:
Part 1 — a TXT record at mta-sts.yourdomain.com:
mta-sts.yourdomain.com. TXT "v=STSv1; id=20260808"
The id is a version string — it must change every time the policy changes, or receivers won't re-fetch it.
Part 2 — the policy file served over HTTPS at:
https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
max_age: 604800
mx: mx1.yourdomain.com
mx: mx2.yourdomain.com
| Directive | Meaning |
|---|---|
version |
Always STSv1 |
mode |
enforce (mandatory TLS), testing (report only), none |
max_age |
How long receivers cache the policy |
mx |
Hostnames that may receive mail — the policy is invalid if these don't match real MX records |
The MTA-STS tool fetches the policy over HTTPS, parses every directive, and cross-checks each mx: entry against the domain's live MX records — a mismatch means receivers will reject the policy.
TLS-RPT: seeing the failures
A policy you can't observe is a guess. TLS-RPT (RFC 8460) is the reporting side: a TXT record at _smtp._tls.yourdomain.com that tells senders where to deliver transport-security reports:
_smtp._tls.yourdomain.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com"
When Gmail tries to send you mail and the TLS connection fails, it emails a JSON report to that address. If you enforce MTA-STS without TLS-RPT, you're enforcing blind.
DANE: pin the certificate in DNS
DANE does for SMTP what HSTS does for HTTPS — but stronger, because the trust anchor is DNSSEC-signed DNS rather than a policy served by the very server you're connecting to.
A TLSA record at _25._tcp.yourdomain.com publishes a hash of the expected certificate or its public key:
_25._tcp.yourdomain.com. TXT "3 1 1 0d0f0a3d8f2c1d4b..."
The four fields are:
| Field | Meaning |
|---|---|
| Usage | 3 domain-issued (typical), 2 trust anchor, 1/0 for CA-based schemes |
| Selector | 0 = hash of the SPKI (public key), 1 = hash of the full certificate |
| Matching type | 1 = SHA-256, 2 = SHA-512, 0 = full data |
| Data | The hex hash |
Because selector 0 hashes the public key, rotating certificates without changing keys doesn't break DANE — that's why it's the recommended choice.
The DANE/TLSA tool connects to your host with TLS, extracts the certificate and its SPKI, computes the SHA-256/512 hashes, and compares them against every published record — a per-record ✅/❌ verdict.
Practical deployment note: DANE only works if your domain is DNSSEC-signed, and it must be tested carefully first — a mismatched TLSA record on an enforcing receiver means your mail stops arriving entirely. Publish, validate with the tool, then enforce.
The checklist
v=STSv1TXT atmta-sts.subdomain with a changingid.- Policy file at
/.well-known/mta-sts.txt— modeenforce,mx:matching your MX records. v=TLSRPTv1TXT at_smtp._tls.so you see failures.- If you run DNSSEC: TLSA records at
_25._tcp., SPKI-based (usage 3, selector 0). - Re-run the MTA-STS tool after every change — the policy's
idmust bump or nothing updates.
Transport security for email is a two-sided agreement. Publishing the records is half; the other half is other people honoring them. The standards are mature, the tooling is free, and the failure mode of not doing it is your mail silently traveling in plaintext — or worse, being quietly redirected. That's not a risk worth taking for a four-field TXT record.