FALKEN'S MAZE / CHECKS / MTA-STS AND TLS-RPT

MTA-STS and TLS-RPT

What Joshua checks

Checks for an MTA-STS policy that makes senders deliver your mail over TLS, and a TLS-RPT record for failure reports.

Why it matters

Without MTA-STS, an attacker on the network can strip TLS from mail on its way to you and read it.

How to fix it

Publish an MTA-STS policy at https://mta-sts.<your domain>/.well-known/mta-sts.txt and the _mta-sts TXT record, start in testing mode, and add a TLS-RPT record at _smtp._tls.

In the Maze Score

Worth

5 points (half for a warning)

Severity

Low

Runs on

Pro (Watchtower) and above

Related checks

• SPF recordFree
• DKIM signingFree
• DMARC policyFree
• Mail serversFree
• SPF lookup limitPro (Watchtower)
• DMARC alignmentPro (Watchtower)
• BIMIPro (Watchtower)