bonus.mtasts.enforce
MTA-STS Enforced
What we check
We fetch the MTA-STS policy file and verify that its mode is set to enforce. This bonus finding is emitted in the Bonus category when MTA-STS enforcement is active.
What this finding means
The domain publishes an MTA-STS policy with mode: enforce. Sending servers that support MTA-STS will require TLS for connections to this domain's MX hosts and verify the server's certificate — they will refuse to deliver in plaintext or to a server with an invalid certificate.
Why it matters
- Active downgrade protection. With
mode: enforce, a network attacker cannot strip STARTTLS or present a forged certificate — compliant senders will refuse delivery rather than downgrade. - No DNSSEC required. Unlike DANE, MTA-STS works without DNSSEC. The policy is fetched over HTTPS, making it deployable by any domain with standard web hosting.
- Bonus recognition. Active MTA-STS enforcement contributes positively to the overall score, recognizing the investment in transport security infrastructure.
Evidence example
Policy: https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: *.example.com
max_age: 604800
MTA-STS enforced — bonus awarded