Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

MTA-STS enforced

Encrypted inbound mail (MTA-STS)

Must other servers encrypt the mail they deliver to this domain?

Why it matters

Mail servers encrypt delivery only when both sides offer it, and an attacker on the network can strip that offer without anyone noticing. MTA-STS publishes a policy that tells senders to refuse delivery unless the connection is encrypted to a named mail server with a valid certificate.

When a domain passes

Passes when the domain publishes an MTA-STS record and a policy file in enforce mode. Applies only to domains that receive mail.

How to fix it

  1. Serve a policy file over HTTPS on the mta-sts subdomain that lists the mail servers, in testing mode first.
  2. Publish the MTA-STS TXT record with an id that changes whenever the policy changes.
  3. Add TLS-RPT to receive failure reports, then switch the policy to enforce.

An example record

https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800

Reference specifications

All thirteen standards