What MTA-STS does
MTA-STS (RFC 8461) lets you require that mail sent to you is delivered over TLS to your listed MX hosts, stopping downgrade and man-in-the-middle attacks in transit. It needs a TXT record at _mta-sts.domain and a policy file at https://mta-sts.domain/.well-known/mta-sts.txt. Start in mode: testing with TLS-RPT enabled, then switch to enforce.
MTA-STS checker: questions
What does MTA-STS protect against?+
Downgrade and interception attacks on mail sent to your domain. Without it, a sending server that cannot negotiate TLS falls back to plaintext, so an attacker on the path can strip STARTTLS or impersonate your MX. With an enforced MTA-STS policy (RFC 8461), supporting senders deliver only over TLS with a valid certificate to the MX hosts your policy lists.
Why can't my MTA-STS policy file be fetched?+
Usually because it is not served exactly as RFC 8461 §3.3 requires: over HTTPS at https://mta-sts.example.com/.well-known/mta-sts.txt, with a valid certificate for mta-sts.example.com, an HTTP 200 response and no redirect. Check that the mta-sts subdomain resolves, that its certificate covers that name, and that nothing redirects to another host. The checker fetches the file the same way, without following redirects.
Does every MX host need to be in the MTA-STS policy?+
Yes. Every MX host must match an mx: line in the policy file, exactly or through a wildcard such as *.example.com, which covers a single label (mx1.example.com, not a.b.example.com). In enforce mode, senders refuse to deliver to an MX host the policy does not list. The checker compares your live MX records against the policy.
What happens to email when MTA-STS enforcement fails?+
The sender does not deliver to the failing MX host. If no listed MX host offers TLS with a valid certificate, the message stays in the sender's queue and is retried, and it bounces if the problem outlasts the retry period. In testing mode the same message is delivered anyway and the failure shows up in TLS-RPT reports.
What is the difference between MTA-STS and DANE?+
Both make senders require valid TLS to your MX hosts, but they establish trust differently. DANE (RFC 7672) publishes TLSA records for each MX host and needs a DNSSEC-signed zone; MTA-STS (RFC 8461) needs no DNSSEC and relies on an HTTPS policy file and certificates from public certificate authorities. A domain can deploy both.