# MTA-STS

MTA-STS (RFC 8461) is a policy a domain publishes in DNS at _mta-sts.<domain> and over HTTPS that tells sending servers to deliver only over authenticated TLS to its named mail hosts.

Date: 2026-09-13

MTA-STS, SMTP MTA Strict Transport Security, is the mechanism of RFC 8461 by which a receiving domain tells sending servers that mail for it must be delivered over TLS with a valid certificate to the mail hosts it names: a TXT record at `_mta-sts.<domain>` announces the policy's version, and the policy itself is fetched over HTTPS from `mta-sts.<domain>`. Without it, SMTP falls back to plain text whenever a connection cannot negotiate TLS, which is exactly what an attacker on the path arranges.

## What Spaw answers

The domain endpoint reports `mta_sts`: whether the DNS record that announces a policy exists. True means the domain has published one; false is a checked negative; null means the lookup failed. The free checker reads it beside TLS-RPT and BIMI.

## What it does not mean

The record's presence does not prove the policy file is reachable or valid, or that the named hosts match the MX records; a full validation fetches and parses the policy, which Spaw does not do. And a domain without MTA-STS is not insecure in itself — most mail still travels over opportunistic TLS — it is a domain that has not closed the downgrade.

Reference: https://spaw.co/glossary/mta-sts