[ Transport security ]
Host an MTA-STS policy file at the correct HTTPS location
Serve the exact MTA-STS HTTPS endpoint directly, validate its certificate and policy body, and coordinate publication with discovery and caches.
By the EmailAuth research team · 8 min read
[ Key points ]
- Use the exact policy hostname, path and HTTPS port.
- Require direct HTTP 200 and preserve certificate and body evidence.
- Coordinate artifact revision, discovery id and cached-policy compatibility.
[ Takeaway ]
Serve the exact MTA-STS HTTPS endpoint directly, validate its certificate and policy body, and coordinate publication with discovery and caches.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Verify the exact HTTPS response
A configuration screen is not end-to-end evidence.
Next steps
- Record exact DNS and policy artifacts.
- Check each relevant endpoint independently.
- Preserve timestamps and controlled acceptance results.
CISO / SecOps
Review enforcement and cached-policy risk
Transport policy changes need a compatible recovery plan.
Next steps
- Review certificates and permitted MX patterns.
- Account for prior cached policies.
- Separate transport results from message authentication.
Founder / Non-technical
Protect incoming-mail continuity
Publication must have accountable service ownership.
Next steps
- Assign DNS, mail and hosting owners.
- Include backup routes and renewal responsibility.
- Require acceptance evidence before enforcement.
[ FAQs ]
Frequently asked questions
What is the policy URL for example.com?
It is https://mta-sts.example.com/.well-known/mta-sts.txt over HTTPS on port 443.
May the endpoint redirect to a storage URL?
No. RFC 8461 forbids following HTTP 3xx redirects during policy fetching. Serve the policy directly at the required endpoint.
Is a browser displaying the policy enough?
No. Browsers may follow redirects or use an authenticated session. Preserve the original unauthenticated response and certificate evidence.
What status and media type should be served?
The fetch requires HTTP 200. RFC 8461 says senders SHOULD validate text/plain; publish the intended plain-text policy with that media type.
Is the HTTPS certificate the MX certificate?
No. The policy host and receiving SMTP servers are different endpoints with separate hostname and certificate checks.
Is max_age the DNS TTL?
No. It is the policy cache lifetime in seconds, distinct from DNS TTL and HTTP cache controls.
Does changing id purge all sender caches?
No. It lets senders detect a revision but is not a global cache-purge operation. Preserve compatibility during transition.
Can deleting the endpoint safely disable MTA-STS?
Do not assume so. Review none mode and previous cached policies, and maintain the endpoint as required by the approved retirement plan.
[ Sources ]
Sources
[ Glossary ]
Glossary
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption