Does MTA-STS encrypt my email?

It does not add encryption; it prevents encryption from being silently removed. TLS between mail servers already exists but is optional and strippable. MTA-STS makes a supporting sender treat encryption as required for your domain, so a downgrade attempt fails instead of quietly succeeding.

Why is the policy served over HTTPS instead of DNS?

Because the web certificate is what proves the policy is genuinely yours. DNS without DNSSEC can be spoofed, and MTA-STS was designed to work for domains that do not deploy DNSSEC, so it substitutes the certificate for that trust.

ConceptMTA-STS

What is MTA-STS?

MTA-STS (Mail Transfer Agent Strict Transport Security) tells other mail servers that they must use encryption when delivering mail to your domain, and refuses delivery if they cannot. Normally server-to-server encryption is optional and can be silently stripped by a network attacker, downgrading the connection to plaintext without anyone noticing. MTA-STS closes that gap by publishing, over HTTPS, a policy that says encryption is required and lists which mail servers are legitimate.

See it on your own domainMTA-STS checker

The downgrade attack it prevents

When one mail server delivers to another it encrypts only if the receiving side offers STARTTLS. An attacker positioned in the path can delete that offer, and the sending server, with no way to know it was ever there, continues in plaintext. Nothing bounces and nothing is logged. MTA-STS makes a supporting sender refuse to deliver over an unencrypted connection to your domain, so the downgrade fails closed rather than open.

The three pieces it needs

MTA-STS is split between DNS and HTTPS on purpose. A TXT record at _mta-sts announces that a policy exists and carries a version id. The policy itself is served at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, where a valid certificate proves it came from you. Start the policy in testing mode (which reports failures without blocking mail) and pair it with a TLS-RPT record so you receive those reports, then switch to enforce once the reports are clean.

Common questions

Does MTA-STS encrypt my email?: It does not add encryption; it prevents encryption from being silently removed. TLS between mail servers already exists but is optional and strippable. MTA-STS makes a supporting sender treat encryption as required for your domain, so a downgrade attempt fails instead of quietly succeeding.
Why is the policy served over HTTPS instead of DNS?: Because the web certificate is what proves the policy is genuinely yours. DNS without DNSSEC can be spoofed, and MTA-STS was designed to work for domains that do not deploy DNSSEC, so it substitutes the certificate for that trust.