An SMTP TLS downgrade attack tries to make mail use weaker transport than the legitimate endpoints support. It can target the STARTTLS advertisement, DNS routing or discovery of an enforcement policy. The right mitigation depends on which trusted state the sending system already has and which authentication checks it actually performs.
Separate the attack surfaces
References: RFC 3207 §6, RFC 8461 §10.2.
Consider a sender delivering to example.com through mx1.example.net. An attacker on an unprotected network path may remove STARTTLS from the server's EHLO response. If the sender's effective policy permits non-TLS delivery, the conversation can continue without encryption. A successful TLS scan from another location does not contradict that possibility. RFC 3207 section 6.
A different attack changes unauthenticated routing data so that the sender reaches another host. A third suppresses initial MTA-STS discovery or retrieval so that a sender with no cached policy cannot learn an enforcing requirement. These are different failures: a test that only removes STARTTLS does not establish resistance to DNS manipulation or first-contact policy suppression.
Match controls to trusted state
References: RFC 8461 §3.3, RFC 8461 §5, RFC 8461 §2, RFC 7672 §2.1.
For supporting senders, an unexpired enforcing MTA-STS policy requires the authorised MX and validated TLS conditions even when current discovery is disrupted. Without a usable cached policy and without successful acquisition, MTA-STS cannot provide the same guarantee. Other sender controls may still require TLS; absence of MTA-STS is not an instruction to send plaintext. RFC 8461 sections 5.1 and 10.2.
SMTP DANE authenticates relevant DNS discovery using DNSSEC and validates the service using TLSA. Its resistance depends on a secure validation path and a sender implementing the required checks. Bogus DNSSEC data must not be silently reclassified as ordinary unsigned data. A secure TLSA mismatch cannot be excused because an unrelated HTTPS policy passes. RFC 7672 sections 2 and 3.
Build controlled negative cases
References: RFC 8461 §5, RFC 7672 §3.
Use a lab domain and an isolated sending MTA, with explicit approval for any traffic interception in that environment. Record a baseline with TLS and valid peer authentication. Then vary one condition at a time: no STARTTLS advertisement, failed handshake, incorrect peer key, unavailable policy fetch, and cold versus warm MTA-STS cache. Keep the endpoint constant where possible so the result is attributable to the changed condition.
A retained synthetic decision model represents cold-cache suppression as no MTA-STS requirement, warm enforcing-cache suppression as continued enforcement, and TLSA mismatch as failed DANE authentication. It does not intercept packets or simulate a real resolver. This model supplies no wire evidence, live DNSSEC validation or actual sender queue behavior. The separate historical loopback observations described below are narrower than those acceptance requirements.
Measure both security and availability
References: RFC 8461 §8.4, RFC 8460 §4.1.
A control that blocks an insecure route can cause mail to queue when no compliant alternative is available. That is an expected tradeoff, not proof the control failed. Investigate alternate MX routes and subsequent retries before describing a single failed connection as permanent message loss. Conversely, successful delivery through an unprotected fallback is not evidence of successful downgrade resistance.
Monitor transport reports and policy availability, and retain the sender's reason for accepting or rejecting each route. Reports are delayed and not universal, so silence is not proof an attack never happened. Keep conclusions bounded to the tested paths and states. Separate retained 7 November 2026 records contain timestamped loopback STARTTLS connections alongside the decision model. They were inspected but the network sessions were not rerun for this revision. The lab client refuses a presented certificate B when only A is trusted; A is the successful control. With STARTTLS deliberately absent at the controlled server, the warm-policy input refuses the route and the cold-policy input records no policy guarantee without attempting delivery. Cache state is a configured fixture, not a discovered production MTA cache. There was no packet interception, Internet SMTP session or production queue observation. The recorded results describe this bounded lab client and must not be presented as a test of every sending implementation.