Is STARTTLS enough on its own?

Against passive observation, largely. Against an active attacker on the path, no — the advertisement can be removed and both sides fall back to plaintext without noticing.

Does MTA-STS protect the mail I send?

No. It tells other servers how to treat mail addressed to your domain, so it protects incoming mail. Outgoing mail depends on the recipient domain's own policy.

Should I publish TLS reporting without MTA-STS?

Yes, it stands on its own. It surfaces certificate problems and downgrade attempts against your mail servers regardless of whether a policy is enforced.

Glossary

STARTTLS

STARTTLS is an SMTP command that upgrades a plaintext connection between two mail servers to an encrypted one. Its defining property is that it is opportunistic: the connection starts unencrypted, the server advertises the capability, and the client may use it. Anything in the network path that removes the advertisement causes both sides to continue in plaintext, and neither notices — which is the weakness MTA-STS exists to close.

How the upgrade works

The client connects in plaintext and asks the server what it supports.

The server lists its capabilities, including the upgrade command where it is available.

The client issues the command, the two negotiate encryption, and the session restarts inside it.

The message is then transmitted encrypted, over a connection that began in the clear.

This is different from connecting to a dedicated encrypted port, where encryption is established before anything else happens.

Why opportunistic means strippable

If the capability advertisement is removed in transit, the client concludes the server does not support encryption.

The correct behaviour for opportunistic encryption at that point is to continue in plaintext, because refusing would mean failing to deliver mail to servers that genuinely have no support.

So an attacker positioned on the path does not need to break anything — only to delete a line from a response.

Certificate validation is also frequently skipped, because a strict client would refuse delivery to the many mail servers with imperfect certificates.

Which leaves a mechanism that encrypts reliably against passive observation and much less reliably against an active one.

What MTA-STS adds

A policy published over HTTPS stating that your domain's mail servers support encryption and naming them.

A sending server that has fetched that policy will refuse to deliver over an unencrypted connection, which removes the downgrade.

The policy is discovered through a DNS record and fetched over HTTPS with a valid certificate, so an attacker on the SMTP path cannot suppress it.

It is advisory in one direction only: it protects mail coming to you, because it tells other people's servers how to treat your domain.

DANE achieves a similar result by publishing certificate constraints in DNS secured by DNSSEC, which is stronger and deployed far less widely.

What TLS reporting adds

A separate DNS record naming an address that receives reports about failed encrypted connections to your mail servers.

It is what makes a policy in testing mode useful: without it, a testing policy produces no observable information.

The reports also surface problems the policy did not cause — an expired certificate on a mail server, a downgrade attempted on the path.

It is independent of MTA-STS and worth publishing on its own merits.

Together they turn an opportunistic mechanism into one you can both enforce and observe.

How it is observed

The MTA-STS DNS record and the policy file served over HTTPS are both retrieved, since either alone does nothing.

The policy's enforcement mode and its mail server list are read and compared against the exchangers published in DNS.

The TLS reporting record is retrieved separately.

No SMTP connection is opened, so the encryption a mail server really offers is not tested here — that is what the reports cover over time.

Frequently asked questions

Is STARTTLS enough on its own?: Against passive observation, largely. Against an active attacker on the path, no — the advertisement can be removed and both sides fall back to plaintext without noticing.
Does MTA-STS protect the mail I send?: No. It tells other servers how to treat mail addressed to your domain, so it protects incoming mail. Outgoing mail depends on the recipient domain's own policy.
Should I publish TLS reporting without MTA-STS?: Yes, it stands on its own. It surfaces certificate problems and downgrade attempts against your mail servers regardless of whether a policy is enforced.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website