Safety
MTA-STS vs DMARC for Public Domain Email
September 23, 2024
MTA-STS vs DMARC for public domain email is two layers that do not replace each other. DMARC (with SPF and DKIM) is how you tell receivers what to do when From alignment fails — none, quarantine, or reject. MTA-STS (RFC 8461) is a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt plus a DNS TXT on _mta-sts that tells sending MTAs to use SMTP TLS to your MX and not silently fall back to cleartext. TLS-RPT is the reporting cousin. A marketing site scan of https://example.com does not see MX. RoastMyOpsec does not fetch mta-sts.txt, does not query DNS TXT, and does not score missing MTA-STS as an F.
The practical difference
SPF/DKIM/DMARC fight spoofed From on the domain people see. MTA-STS fights opportunistic downgrade on the path to your mail servers. CAA and registrar lock are issuance and transfer controls — different jobs. See SPF vs DKIM vs DMARC.
A policy mode testing is how you roll out MTA-STS without locking out a mis-set MX. enforce is a commitment, like HSTS preload: get certificates and MX names right first.
How to choose a policy
Every public brand domain that sends mail: SPF, DKIM, DMARC at least p=none with a rua you read, then tighten. MTA-STS: add it when you control the MX and can keep the HTTPS policy host and leaf certs healthy. Skip MTA-STS on a domain that only forwards to a mailbox you do not operate until that operator documents it. Do not publish an enforce policy that names an MX you cannot TLS.
| Control | What it covers | Failure mode | Takeaway |
|---|---|---|---|
| SPF / DKIM / DMARC | From alignment and disposition | p=reject before mail flows are clean | Do this first |
| MTA-STS | SMTP TLS to your MX | Stale policy or dead mta-sts host | Extra; not a roast F |
| TLS-RPT | Reports about TLS failures | Mailbox you ignore | Pair with MTA-STS |
| HTTPS on the website | Browser to origin | Unrelated to MX | Different layer |
When MTA-STS wins
MTA-STS wins after DMARC is real and you operate the MX. DMARC still wins as the spoofing control. Missing MTA-STS on a brochure domain is not a roast finding. Pair with DNS hygiene if the mta-sts hostname is a dangling CNAME.
What the roast can prove
Nothing about MX or MTA-STS. The scan is a consented GET to the URL you paste. Confirm DNS and the policy file in your mail console. Pair with security.txt if you also want a researcher inbox on the web origin.
Common mistakes
The first mistake is MTA-STS enforce while the policy HTTPS host uses a leftover Let's Encrypt name that expired.
The second mistake is treating website HSTS as SMTP TLS.
The third mistake is skipping DMARC because MTA-STS 'sounds stronger.'
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does MTA-STS replace DMARC?
- No. DMARC is From alignment. MTA-STS is SMTP TLS policy to your MX. Ship DMARC first.
- Should every marketing domain enable MTA-STS?
- Only if you control the MX and can keep the policy host healthy. Missing it is not a roast F.
- Does RoastMyOpsec check MTA-STS?
- No. It does not query MX, TXT, or /.well-known/mta-sts.txt.