[ Protocols & standards ]
Transport security
Encrypt mail in transit with MTA-STS, TLS-RPT and DANE, and read the reports that prove it works.
40 guides
[ Core guides ]
[ All guides ]
Article
Unraveling the Complex Relationship Between Email Authentication and Encryption.
Take a closer look at the complex relationship between email authentication and encryption. Learn how to ensure your emails are secure!
Guide
Build transport-security alerts that lead to an investigation
Create transport-security alerts with a clear denominator, coverage signal, owner and investigation path instead of paging on every aggregate failure.
Guide
Certificate-name failures in SMTP TLS reports
Investigate certificate-name failures against the reported SMTP endpoint and applied policy, keeping policy-host HTTPS identity separate.
Guide
Compare transport-policy failures with authentication failures
Distinguish SMTP transport-policy failures from SPF, DKIM and DMARC results using delivery-stage evidence and trusted observations.
Guide
Create and verify a TLS-RPT DNS record
Publish one correctly formed TLS-RPT record and verify both DNS discovery and the receiving report destination.
Guide
DANE and MTA-STS: compare trust models and deployment needs
Compare DANE and MTA-STS on the same receiving route, including authenticated discovery, first contact and certificate rollover.
Guide
DANE for SMTP: understand DNSSEC and TLSA dependencies
Trace secure MX discovery, TLSA usability and usage-specific certificate matching before treating an SMTP route as DANE authenticated.
Guide
DANE validation failures after a certificate or key change
Diagnose DANE breakage by comparing the served certificate, secure TLSA answer and deployment timeline before changing trust policy.
Guide
Deduplicate TLS reports and preserve reporting-period context
Deduplicate report ingestion without losing corrections, policy scope or the difference between observation time and arrival time.
Guide
Expired or untrusted certificates in SMTP TLS reports
Distinguish expiry from trust-chain failure, preserve the reported endpoint and validate the certificate actually served after renewal.
Guide
Host an MTA-STS policy file at the correct HTTPS location
Serve the exact MTA-STS HTTPS endpoint directly, validate its certificate and policy body, and coordinate publication with discovery and caches.
Guide
MTA-STS certificate and HTTPS-chain failures
Separate the HTTPS policy certificate from receiving-MX certificates and diagnose the exact failing trust or hostname check.
Guide
MTA-STS certificate renewal without policy-host outages
Prevent MTA-STS policy-host outages with renewal ownership, deployed certificate checks, direct HTTPS validation and clear separation from SMTP certificates.
Guide
MTA-STS during a mail-provider migration
Expand policy compatibility before moving mail routes, and retain overlap so senders with older policies can still deliver safely.
Guide
MTA-STS explained through the receiving domain's mail route
Map receiving MX destinations, TLS requirements and cached policy before selecting an MTA-STS enforcement mode.
Guide
MTA-STS fetch failures and unexpected HTTP responses
Explain MTA-STS fetch failures caused by redirects, HTTP status, certificates, body content and timeouts, while keeping cached-policy behavior distinct.
Guide
MTA-STS first-connection limits and cached-policy protection
Understand MTA-STS first-connection limits through empty, valid and expired cache states, enforce-mode behavior, DANE boundaries and report limitations.
Guide
MTA-STS for a large domain portfolio
Manage per-domain receiving routes, ownership, policy history and rollout evidence without treating shared hosting or templates as universal readiness.
Guide
MTA-STS for domains with multiple MX providers
Validate primary, backup and migration MX routes across providers, including hostname patterns, TLS evidence and cached-policy transitions.
Guide
MTA-STS MX matching and wildcard rules
Match each receiving MX hostname against narrowly scoped policy patterns, then validate its certificate separately.
Guide
MTA-STS policy caching and delayed changes
Plan policy changes around the sender’s fetched-policy lifetime as well as DNS TTL, rather than expecting one edit to update every sender.
Guide
MTA-STS policy discovery and the DNS policy identifier
Use the DNS id to announce a policy revision, without treating it as the policy itself or a command that clears sender caches.
Guide
MTA-STS policy missing: trace discovery before adding records
Diagnose a missing MTA-STS policy by tracing the exact domain, discovery TXT answer, HTTPS response, MX scope and sender cache before editing records.
Guide
MTA-STS policy syntax: version, mode, MX and max_age
Validate the policy body separately from the discovery TXT record, and preserve the meaning of each required field.
Guide
MTA-STS rollback: account for senders with cached policy
Recover from a faulty MTA-STS change without assuming that deleting DNS or lowering max_age removes existing enforcement.
Guide
MTA-STS setup: verify DNS, HTTPS and mail delivery together
Build a receiving-domain transport policy, check every inbound route and plan changes around sender caches.
Guide
MTA-STS testing and enforce modes: choose a safe transition
Move from testing to enforce only after identifying transport failures and proving that all intended receiving routes remain usable.
Guide
No TLS reports arriving: check support, traffic and collection
Separate missing sender observations from discovery, delivery, integrity, parsing and dashboard failures when TLS reports are absent.
Guide
Publish and rotate TLSA records without breaking SMTP delivery
Plan fixed-parameter TLSA rollover with prepublication, cache-aware overlap, fleet verification and a recovery boundary before removing old associations.
Guide
Read TLS-RPT JSON fields and failure categories
Read the report envelope, policy scope and session summaries before interpreting individual transport failures.
Guide
Serverless MTA-STS hosting: assess availability and change control
Assess a documented Azure Static Web Apps policy-host route for exact path delivery, custom-domain TLS, routing behavior and cache-aware releases.
Guide
SMTP TLS downgrade attacks and available controls
Model SMTP downgrade threats at discovery, negotiation and certificate validation, then test the relevant control without weakening production.
Guide
STARTTLS, opportunistic TLS and enforced transport policy
Distinguish TLS capability, negotiated encryption and authenticated enforcement before describing an SMTP route as secure.
Guide
Test transport security without treating a checker as proof of every delivery path
Turn transport-checker output into a scoped test record that identifies what was observed, what was inferred and which delivery paths remain untested.
Guide
TLS negotiation failures and unsupported protocol settings
Use TLS reports to locate negotiation failures, then reproduce the handshake safely before changing supported protocol settings.
Guide
TLS-RPT explained through a transport-failure report
Interpret TLS-RPT reports using a fictional failure example, session-count arithmetic, policy context, authenticated reporting and current RFC errata.
Guide
TLS-RPT reporting destinations and report delivery
Define approved mailto or HTTPS collection paths, report integrity, timing and processing responsibilities without assuming guaranteed duplicate delivery.
Guide
Transport encryption and S/MIME: separate hop protection from message protection
Map TLS and S/MIME to one message path so hop encryption, content confidentiality and signature verification are not mistaken for one control.
Related free tools
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More in Protocols & standards ]
DMARC foundations and policy
How DMARC works, how to choose and tighten a policy, and how to reach p=reject safely with alignment you can trust.
20 guides
SPF
Sender Policy Framework from first record to flattening: syntax, includes, the 10-lookup limit and safe changes.
11 guides
DKIM
Keys, selectors, signatures and rotation: everything you need to sign mail and keep DKIM aligned.
8 guides
BIMI and brand identity
Put your verified logo in the inbox: BIMI records, SVG Tiny-PS logos, VMC and CMC certificates.
7 guides