Transport Security
If you only read one
MTA-STS (SMTP MTA Strict Transport Security, RFC 8461)
How receiving domains publish an enforceable TLS policy via a DNS TXT record plus an HTTPS policy file, and how sending MTAs discover, cache, and apply it. 5 min
- MTA-STS (SMTP MTA Strict Transport Security, RFC 8461)
How receiving domains publish an enforceable TLS policy via a DNS TXT record plus an HTTPS policy file, and how sending MTAs discover, cache, and apply it.
- SMTP TLS Reporting (TLS-RPT, RFC 8460)
The reporting channel for SMTP transport security — DNS record syntax, JSON report schema, the full failure result-type taxonomy, and how to use the reports operationally.
- DANE for SMTP (RFC 7672)
DNSSEC-authenticated TLS for SMTP — TLSA record placement and parameters, the sending-MTA validation algorithm, failure handling, and how DANE compares to MTA-STS.
- SMTP TLS in Practice (STARTTLS, Implicit TLS, REQUIRETLS, version floors)
The sender-side TLS layer for mail — RFC 3207 STARTTLS mechanics, RFC 7435 opportunistic security, RFC 8314 implicit TLS on 465/587, RFC 8689 REQUIRETLS, and the RFC 8996 TLS 1.0/1.1 deprecation.
- TLS for Mail: M3AAWG Baseline Recommendations (April 2026)
The industry TLS floor — opportunistic TLS everywhere with only TLS 1.2/1.3, encrypted intracompany traffic, encrypted user access (993/995/465/587/HTTPS), and TLS version/cipher logging feeding TLS-RPT.
- NIST SP 800-177r1 — Trustworthy Email (digest)
The US federal reference for email security — its numbered security recommendations across SPF, DKIM, DMARC, TLS, DANE/MTA-STS and S/MIME, the threat/mitigation matrix, and the federal-compliance context (BOD 18-01, FISMA, SP 800-52/800-53).
- SMTP Smuggling — End-of-DATA Discrepancy Spoofing
How mismatched end-of-DATA parsing between MTAs (bare <LF>.<LF> vs standard <CR><LF>.<CR><LF>) lets an attacker smuggle a second spoofed message that inherits the session's authenticated domain and passes SPF/DKIM/DMARC; the Dec 2023 SEC Consult disclosure and the receiver-side fixes.
- DANE for SMTP (RFC 7672)
DNSSEC-authenticated TLS for SMTP — TLSA record placement and parameters, the sending-MTA validation algorithm, failure handling, and how DANE compares to MTA-STS.
- MTA-STS (SMTP MTA Strict Transport Security, RFC 8461)
How receiving domains publish an enforceable TLS policy via a DNS TXT record plus an HTTPS policy file, and how sending MTAs discover, cache, and apply it.
- NIST SP 800-177r1 — Trustworthy Email (digest)
The US federal reference for email security — its numbered security recommendations across SPF, DKIM, DMARC, TLS, DANE/MTA-STS and S/MIME, the threat/mitigation matrix, and the federal-compliance context (BOD 18-01, FISMA, SP 800-52/800-53).
- SMTP Smuggling — End-of-DATA Discrepancy Spoofing
How mismatched end-of-DATA parsing between MTAs (bare <LF>.<LF> vs standard <CR><LF>.<CR><LF>) lets an attacker smuggle a second spoofed message that inherits the session's authenticated domain and passes SPF/DKIM/DMARC; the Dec 2023 SEC Consult disclosure and the receiver-side fixes.
- SMTP TLS in Practice (STARTTLS, Implicit TLS, REQUIRETLS, version floors)
The sender-side TLS layer for mail — RFC 3207 STARTTLS mechanics, RFC 7435 opportunistic security, RFC 8314 implicit TLS on 465/587, RFC 8689 REQUIRETLS, and the RFC 8996 TLS 1.0/1.1 deprecation.
- SMTP TLS Reporting (TLS-RPT, RFC 8460)
The reporting channel for SMTP transport security — DNS record syntax, JSON report schema, the full failure result-type taxonomy, and how to use the reports operationally.
- TLS for Mail: M3AAWG Baseline Recommendations (April 2026)
The industry TLS floor — opportunistic TLS everywhere with only TLS 1.2/1.3, encrypted intracompany traffic, encrypted user access (993/995/465/587/HTTPS), and TLS version/cipher logging feeding TLS-RPT.