====== MTA-STS (Mail Transfer Agent Strict Transport Security) ======

**MTA-STS** (Mail Transfer Agent Strict Transport Security) is an email security standard specified in [[https://datatracker.ietf.org/doc/html/rfc8461|RFC 8461]] that enables mail servers to enforce secure, encrypted **TLS** connections for inbound email traffic.

It prevents Man-in-the-Middle (MitM) and TLS-downgrade attacks by requiring sending servers to negotiate encrypted connections and verify the receiving server's TLS certificate before delivering email.

----

===== How MTA-STS Works =====

When an external mail transfer agent (MTA) attempts to send an email to your domain, it executes the following steps:

  # **DNS TXT Record Check:** Queries DNS for ''_mta-sts.yourdomain.com'' to check if MTA-STS is enabled and if the policy version has changed.
  # **Policy Fetching:** Fetches the host's policy file over HTTPS from ''https://mta-sts.yourdomain.com/.well-known/mta-sts.txt''.
  # **TLS Certificate Verification:** Connects to the destination mail server via SMTP and verifies that its TLS certificate matches the hostnames listed in the MTA-STS policy file.
  # **Enforcement:**
    * If TLS validation succeeds: Delivers the email over an encrypted TLS connection.
    * If TLS validation fails or is tampered with (in ''enforce'' mode): Aborts delivery and drops the unencrypted connection.

----

===== Step 1: MTA-STS Policy File =====

The policy file must be hosted via HTTPS on a dedicated web endpoint at:
''https://mta-sts.yourdomain.com/.well-known/mta-sts.txt''

==== Policy Syntax Example ====
<code>
version: STSv1
mode: enforce
mx: mail.telenegar.ir
mx: *.telenegar.ir
max_age: 604800
</code>

==== Policy Parameters ====

^ Parameter ^ Description ^ Example / Values ^
| **version** | Protocol version. Must be ''STSv1''. | ''STSv1'' |
| **mode** | Deployment mode for policy enforcement. | ''testing'', ''enforce'', or ''none'' |
| **mx** | Allowed mail server hostnames (wildcards like ''*.domain.com'' supported). | ''mx: mail.example.com'' |
| **max_age** | Time-to-live for policy caching in seconds (e.g., ''604800'' = 7 days). | ''604800'' |

==== Policy Modes Explained ====
  * **testing:** Sending MTAs evaluate TLS validity and send failure reports (via [[email:dns-configuration:tls-rpt|TLS-RPT]]), but deliver unencrypted mail if TLS fails. (Recommended for initial setup).
  * **enforce:** Sending MTAs **must** negotiate valid TLS. Delivery is rejected if encryption fails or certificates are invalid.
  * **none:** Disables MTA-STS enforcement.

----

===== Step 2: MTA-STS DNS Record =====

To notify sending MTAs that your domain supports MTA-STS, create a TXT record at ''_mta-sts.yourdomain.com''.

^ Host / Name ^ Type ^ Text / Value ^ TTL ^
| ''_mta-sts'' | **TXT** | ''v=STSv1; id=2026080301;'' | ''3600'' |

==== DNS Tags ====
  * **v=STSv1:** Protocol version tag.
  * **id=YYYYMMDDNN:** Unique identifier string (usually a timestamp or hash). **Note:** Whenever you update your HTTPS policy file, you **must change this ID value** in DNS so remote servers clear their cache and fetch the new policy.

----

===== Prerequisites & Hosting Requirements =====

To implement MTA-STS successfully, satisfy the following infrastructure requirements:

  * **HTTPS Subdomain:** Set up an HTTP/S web server or CDN endpoint resolving to ''mta-sts.yourdomain.com''.
  * **Valid SSL/TLS Certificate:** The HTTPS server for ''mta-sts.yourdomain.com'' must serve a valid, public SSL certificate (e.g., Let's Encrypt).
  * **Correct Path:** Host the plain text file strictly at ''/.well-known/mta-sts.txt'' returning HTTP header ''Content-Type: text/plain''.

----

===== Common Troubleshooting Points =====

==== 1. Expired SSL Certificates on Mail Server ====
In ''enforce'' mode, if your mail server's SSL certificate expires or becomes invalid, external MTAs enforcing MTA-STS will bounce inbound email rather than falling back to plain-text port 25.

==== 2. Mismatched MX Hostnames ====
Ensure every hostname defined in your [[email:dns-configuration:mx-records|MX Records]] is explicitly covered by an ''mx:'' line in your ''mta-sts.txt'' policy file.

==== 3. Stale Cache (Forgot to Update ID) ====
If you modify your MX configuration, remember to update the ''id='' tag in your ''_mta-sts'' DNS record to force external servers to refresh their cached policy.

----

===== Verification & Testing =====

You can verify your MTA-STS record, MX configuration, and TLS status using **Telenegar Tools** or terminal commands:

==== Using Telenegar Tools ====
  * **DNS Lookup:** Validate your ''_mta-sts'' TXT record with the [[tools:dnscheck|Telenegar DNS Check Tool]].
  * **Mail Server Diagnostics:** Audit outbound encryption capabilities and MX setup using the [[tools:mailcheck|Telenegar Mail Check Tool]].

==== Using Terminal Commands ====

=== dig (Linux / macOS) ===
<code> bash
dig +short TXT _mta-sts.example.com
</code>

=== nslookup (Windows / Cross-platform) ===
<code> cmd
nslookup -type=TXT _mta-sts.example.com
</code>

==== Curl Policy Check ====
<code> bash
curl -i https://mta-sts.example.com/.well-known/mta-sts.txt
</code>

----

===== Related Documentation =====

  * [[tools:dnscheck|Telenegar DNS Check Tool]] — Diagnostic tool for DNS record lookup and propagation.
  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email authentication and encryption health.
  * [[email:dns-configuration:tls-rpt|TLS-RPT (TLS Reporting)]] — Receive automated reports on MTA-STS enforcement failures.
  * [[email:dns-configuration:mx-records|MX Records]] — Configure mail exchanger targets for your domain.
  * [[email:dns-configuration:dmarc|DMARC]] — Complete your email security suite alongside MTA-STS.