This article applies to:

• MailMarshal 11.1 and above
• MTA-STS

Question:

• What configuration is required to implement MTA-STS with MailMarshal?

Background:

MTA-STS (Mail Transfer Agent - Strict Transport Security) is a security standard to improve security of TLS (encrypted) email transmission. 

RFC 8461 states:

SMTP MTA Strict Transport Security (MTA-STS) is a mechanism enabling mail service providers (SPs) to declare their ability to receive Transport Layer Security (TLS) secure SMTP connections and to specify whether sending SMTP servers should refuse to deliver to MX hosts that do not offer TLS with a trusted server certificate.

To secure reception with MTA-STS, a domain owner maintains specific DNS records and a policy website. Email senders can use this information to validate that they are connecting over TLS to a legitimate server for the recipient domain.

MailMarshal can validate MTA-STS for the recipient domain when sending email to MX routes. 

• If the domain publishes a MTA-STS policy with mode "Enforce", MailMarshal will only connect to the published servers.
  • The publishing domain must support TLS.
  • The certificate must be valid and have a DNS entry in the Subject Alternative Name (SAN) that corresponds to the receiving host name. Wildcards for the host name are supported.
  • If the receiver does not offer TLS, delivery fails
  • If the receiver's certificate is not valid, delivery fails
  • If the receiving host is not found in the SAN, delivery fails
• If the domain publishes a MTA-STS policy with mode "Testing", messages will be sent using MTA-STS if possible. If MTA-STS is not available for the domain, MailMarshal will send a TLS failure report by email. 
• If the domain does not publish a MTA-STS policy, MailMarshal will fall back to opportunistic TLS, or enforced TLS if specified in configuration.

Setup of MTA-STS for a recipient domain is done outside of MailMarshal and is beyond the scope of this article. As a starting point for more information see the external Related Links below.

MailMarshal Configuration: