MTA-STS & TLS-RPT — Mail Encryption

In short

What is MTA-STS?

What it is

MTA-STS (RFC 8461) is a standard that tells sending servers your domain requires TLS when receiving mail. It is published via DNS and an HTTPS policy, and prevents delivery from falling back to plaintext. TLS-RPT (RFC 8460) is its reporting channel.

How it works

The sender queries the _mta-sts record in your DNS, fetches the policy from mta-sts.yourdomain and applies the mode (testing or enforce). If the certificate or TLS fails in enforce mode, mail is not delivered in the clear. TLS-RPT sends daily success and failure reports.

Who it's for

Organizations across Latin America that handle sensitive mail: banking, healthcare, legal, government and any company that must guarantee confidentiality of mail in transit and meet regulatory frameworks.

What problem it solves

It closes the downgrade attack window on STARTTLS, where a man-in-the-middle strips encryption and reads or alters the mail. With MTA-STS in enforce, that delivery simply does not happen in the clear.

Capabilities

Transport encryption, monitored with no blind spots

MTA-STS policyVerification of the DNS record and the HTTPS policy and its mode.

TLS-RPT reportsCollection and reading of encryption failure reports.

Certificate watchAlerts on expiry or invalid TLS chain of the MX.

Continuous monitoringWebMon checks posture and alerts on any change.

Why it matters

What your operation gains

Mail in transit always encrypted, with no downgrade to plaintext.
Real visibility of encryption failures via TLS-RPT reports.
Early detection of expired certificates or broken policies.
Complement to DMARC, SPF and DKIM for a complete email posture.

FAQ

Frequently asked questions

Does MTA-STS replace DMARC or SPF?

No. MTA-STS protects SMTP transport encryption, while DMARC, SPF and DKIM authenticate the sender. They are complementary layers of the same email security posture.

What is the difference between testing and enforce mode?

In testing, failures are reported via TLS-RPT but mail is still delivered; in enforce, if TLS does not meet the policy, plaintext delivery is rejected. It is best to start in testing and then harden.

What is TLS-RPT for?

TLS-RPT (RFC 8460) makes sending servers deliver you daily reports on the success or failure of encryption when delivering to your domain, giving you visibility of issues before they affect mail.

How does WebMon monitor MTA-STS?

WebMon continuously verifies the DNS record and the HTTPS policy, processes your TLS-RPT reports and watches the MX certificate, alerting you to any change or encryption failure.

MTA-STS and TLS-RPT: mandatory encryption for your mail transport.