Blog
Notes on email authentication
Practical articles on DMARC, SPF, DKIM, MTA-STS and email deliverability from the DMARCHub Team.
Advanced topics · 8 September 2026 · 9 min read
What is MTA-STS? Strict transport security for email explained
STARTTLS encrypts email in transit, but an attacker on the network path can strip it without either server noticing. MTA-STS closes that gap: a DNS record plus a small HTTPS policy file that tells sending servers your domain requires encrypted, certificate-validated delivery. Here is how the mechanism works and how to deploy it safely.