What MTA-STS does
MTA-STS lets a receiving domain publish a policy that supporting senders use to require authenticated TLS when delivering SMTP mail. It combines a DNS signal with an HTTPS-hosted policy and can constrain accepted receiving hosts. It addresses transport security; it is not end-to-end message encryption or a sender-reputation mechanism. [IETF RFC 8461: MTA-STS]
What TLS reports add
SMTP TLS Reporting allows participating senders to report aggregate information about successful and failed secure transport attempts. The reports help investigate certificate, policy and connectivity issues. They are not records of whether a user read a message. [IETF RFC 8460: SMTP TLS reporting]
How we would introduce it
- Confirm receiving hosts, certificates, domain ownership and policy-hosting responsibilities.
- Review how supporting senders behave and what evidence the reporting route will retain.
- Use an agreed test and observation plan before enforcing a production change.
- Document policy caching, rollback limitations and responsibility for certificate renewal.
We include transport policy in the relevant Email Project and its change record. Review it alongside sender authentication.
Primary sources
Provider requirements and product capabilities can change. Check the linked source before a production change.