RoastMyOpsec

Safety

MTA-STS vs DMARC for Public Domain Email

September 23, 2024

MTA-STS vs DMARC for public domain email is two layers that do not replace each other. DMARC (with SPF and DKIM) is how you tell receivers what to do when From alignment fails — none, quarantine, or reject. MTA-STS (RFC 8461) is a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt plus a DNS TXT on _mta-sts that tells sending MTAs to use SMTP TLS to your MX and not silently fall back to cleartext. TLS-RPT is the reporting cousin. A marketing site scan of https://example.com does not see MX. RoastMyOpsec does not fetch mta-sts.txt, does not query DNS TXT, and does not score missing MTA-STS as an F.

The practical difference

SPF/DKIM/DMARC fight spoofed From on the domain people see. MTA-STS fights opportunistic downgrade on the path to your mail servers. CAA and registrar lock are issuance and transfer controls — different jobs. See SPF vs DKIM vs DMARC.

A policy mode testing is how you roll out MTA-STS without locking out a mis-set MX. enforce is a commitment, like HSTS preload: get certificates and MX names right first.

How to choose a policy

Every public brand domain that sends mail: SPF, DKIM, DMARC at least p=none with a rua you read, then tighten. MTA-STS: add it when you control the MX and can keep the HTTPS policy host and leaf certs healthy. Skip MTA-STS on a domain that only forwards to a mailbox you do not operate until that operator documents it. Do not publish an enforce policy that names an MX you cannot TLS.

ControlWhat it coversFailure modeTakeaway
SPF / DKIM / DMARCFrom alignment and dispositionp=reject before mail flows are cleanDo this first
MTA-STSSMTP TLS to your MXStale policy or dead mta-sts hostExtra; not a roast F
TLS-RPTReports about TLS failuresMailbox you ignorePair with MTA-STS
HTTPS on the websiteBrowser to originUnrelated to MXDifferent layer

When MTA-STS wins

MTA-STS wins after DMARC is real and you operate the MX. DMARC still wins as the spoofing control. Missing MTA-STS on a brochure domain is not a roast finding. Pair with DNS hygiene if the mta-sts hostname is a dangling CNAME.

What the roast can prove

Nothing about MX or MTA-STS. The scan is a consented GET to the URL you paste. Confirm DNS and the policy file in your mail console. Pair with security.txt if you also want a researcher inbox on the web origin.

Common mistakes

The first mistake is MTA-STS enforce while the policy HTTPS host uses a leftover Let's Encrypt name that expired.

The second mistake is treating website HSTS as SMTP TLS.

The third mistake is skipping DMARC because MTA-STS 'sounds stronger.'

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Does MTA-STS replace DMARC?
No. DMARC is From alignment. MTA-STS is SMTP TLS policy to your MX. Ship DMARC first.
Should every marketing domain enable MTA-STS?
Only if you control the MX and can keep the policy host healthy. Missing it is not a roast F.
Does RoastMyOpsec check MTA-STS?
No. It does not query MX, TXT, or /.well-known/mta-sts.txt.

Sources

Related guides