The vulnerability of opportunistic STARTTLS
Traditional email transfer uses opportunistic TLS: if an attacker intercepts the connection (MITM) and strips the STARTTLS command, mail servers silently fall back to sending emails in plain unencrypted text.
MTA-STS (RFC 8461) closes this vulnerability by publishing an authoritative HTTPS policy requiring sending mail transfer agents (MTAs) to enforce TLS with valid certificates.
1. Publishing the MTA-STS Policy File
Host a plain-text file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt:
TEXT
version: STSv1
mode: enforce
mx: feedback-smtp.us-east-1.amazonses.com
mx: *.sadasend.com
max_age: 6048002. Configuring DNS Records
Add the corresponding DNS TXT records to announce MTA-STS and receive automated TLS-RPT failure reports from Google and Microsoft.
DNS
; MTA-STS Announcement Record
_mta-sts.yourdomain.com. IN TXT "v=STSv1; id=2026082501;"
; TLS-RPT Aggregate Reporting Record
_smtp._tls.yourdomain.com. IN TXT "v=TLSRPTv1; rua=mailto:tls-reports@sadasend.com;"Free plan
Building AI agents that send email?
Scoped API keys, per-key recipient allowlists, approval mode and a hosted MCP server with ten tools — on the free plan, without a card.