MTA-STS and TLS-RPT, and when they are worth it
25 July 2026 · 5 min read
STARTTLS is negotiated in the clear. An attacker in the path can strip the offer and the sending server, having no policy telling it otherwise, will happily deliver in plaintext.
MTA-STS
You publish a policy saying "mail for this domain must be delivered over TLS to these hosts, with a valid certificate". Senders that support it will refuse to downgrade. It needs a DNS record and a policy file served over HTTPS on a mta-sts subdomain, which means a certificate.
TLS-RPT
One DNS record asking senders to report TLS failures to you. No web server, no certificate, and it tells you when delivery to you is failing for reasons you would otherwise never hear about. If you do only one, do this one.
_smtp._tls.example.com TXT "v=TLSRPTv1; rua=mailto:tls-report@example.com"
More on deliverability
SPF, DKIM and DMARC in plain English
Three records, three different jobs, and one relationship between them that explains almost every "why is my mail in spam" question.
Why forwarded mail lands in spam
Forwarding breaks SPF every single time, by design. What keeps forwarded mail out of the spam folder is DKIM surviving the trip, and that is easy to break.
Why a good mail server refuses instead of bouncing
Accepting a message you cannot deliver turns you into a spam cannon aimed at whoever was forged as the sender.