MTA-STS (Mail Transfer Agent Strict Transport Security) and TLS-RPT (SMTP TLS Reporting) are two related email standards that make server-to-server email encryption reliable. MTA-STS lets a domain require that inbound mail be delivered over an encrypted, authenticated TLS connection, and TLS-RPT lets it receive daily reports about any connections that failed to encrypt.
How MTA-STS and TLS-RPT work
MTA-STS (RFC 8461) publishes a policy — via a DNS record and an HTTPS-hosted policy file — telling sending servers to use TLS with a valid certificate and to refuse to deliver if encryption cannot be established. This closes the gap in opportunistic STARTTLS, which a network attacker can strip. TLS-RPT (RFC 8460) adds a DNS record naming an address that receives JSON reports of TLS negotiation results, so you can spot delivery or downgrade problems. Both rely on correct DNS and MX records.
Why MTA-STS and TLS-RPT matter
Together, MTA-STS and TLS-RPT protect messages in transit from interception and downgrade attacks, and give visibility into TLS failures you would otherwise never see — a growing expectation for senders handling sensitive data. They sit alongside SMTPS and email authentication as part of a hardened sending setup. See DNS and SPF configuration or explore Mailpro's deliverability routing.
Mailpro and secure delivery
Encrypted, authenticated delivery by default
Mailpro sends over modern, encrypted connections and manages the deliverability infrastructure for you, so your mail is protected in transit without you configuring servers.