Transport Security

• DANE for SMTP (RFC 7672)

  DNSSEC-authenticated TLS for SMTP — TLSA record placement and parameters, the sending-MTA validation algorithm, failure handling, and how DANE compares to MTA-STS.

• MTA-STS (SMTP MTA Strict Transport Security, RFC 8461)

  How receiving domains publish an enforceable TLS policy via a DNS TXT record plus an HTTPS policy file, and how sending MTAs discover, cache, and apply it.

• NIST SP 800-177r1 — Trustworthy Email (digest)

  The US federal reference for email security — its numbered security recommendations across SPF, DKIM, DMARC, TLS, DANE/MTA-STS and S/MIME, the threat/mitigation matrix, and the federal-compliance context (BOD 18-01, FISMA, SP 800-52/800-53).

• SMTP Smuggling — End-of-DATA Discrepancy Spoofing

  How mismatched end-of-DATA parsing between MTAs (bare <LF>.<LF> vs standard <CR><LF>.<CR><LF>) lets an attacker smuggle a second spoofed message that inherits the session's authenticated domain and passes SPF/DKIM/DMARC; the Dec 2023 SEC Consult disclosure and the receiver-side fixes.

• SMTP TLS in Practice (STARTTLS, Implicit TLS, REQUIRETLS, version floors)

  The sender-side TLS layer for mail — RFC 3207 STARTTLS mechanics, RFC 7435 opportunistic security, RFC 8314 implicit TLS on 465/587, RFC 8689 REQUIRETLS, and the RFC 8996 TLS 1.0/1.1 deprecation.

• SMTP TLS Reporting (TLS-RPT, RFC 8460)

  The reporting channel for SMTP transport security — DNS record syntax, JSON report schema, the full failure result-type taxonomy, and how to use the reports operationally.

• TLS for Mail: M3AAWG Baseline Recommendations (April 2026)

  The industry TLS floor — opportunistic TLS everywhere with only TLS 1.2/1.3, encrypted intracompany traffic, encrypted user access (993/995/465/587/HTTPS), and TLS version/cipher logging feeding TLS-RPT.