Why do you need MTA-STS?

Security had to be retrofitted in SMTP to make sure it was backward compatible by adding the STARTTLS command to initiate TLS encryption, in case the client doesn’t support TLS the communication falls back to cleartext. 

STARTTLS was not perfect, and it failed to address two major problems: the first being that it is an optional measure using opportunistic encryption, hence STARTTLS fails to prevent man-in-the-middle (MITM) attacks. This is because a MITM attacker can easily modify a connection and prevent the encryption update from taking place. The second problem with it is that even if STARTTLS is implemented, there is no way to authenticate the identity of the sending server as SMTP mail servers do not validate certificates.

While most outgoing emails today are secured with Transport Layer Security (TLS) encryption, an industry standard adopted even by consumer email, attackers can still obstruct and tamper with your email even before it gets encrypted. If you email to transport your emails over a secure connection, your data could be compromised or even modified and tampered with by a cyber attacker. Here is where MTA-STS steps in and fixes this issue, guaranteeing safe transit for your emails as well as successfully mitigating MITM attacks. Furthermore, MTAs store MTA-STS policy files, making it more difficult for attackers to launch a DNS spoofing attack.

MTA-STS offers protection against :

• Man-In-The-Middle (MITM) attacks like DNS Spoofing and Downgrade attacks
• It solves multiple SMTP security problems, including expired TLS certificates and a lack of support for secure protocols.

Why Do Emails Require Encryption in Transit?

Since security had to be retrofitted in SMTP to make sure it was backward compatible by adding the STARTTLS command to initiate TLS encryption, in case the client doesn’t support TLS the communication falls back to cleartext. This way emails in transit can fall prey to pervasive monitoring attacks like MITM, wherein cybercriminals can eavesdrop on your messages, and alter and tamper with information by replacing or deleting the encryption command (STARTTLS),making the communication roll back to plaintext.

This is where MTA-STS comes to the rescue, making TLS encryption mandatory in SMTP. This helps in reducing the threats of MITM, DNS Spoofing, and Downgrade attacks.

After successfully configuring MTA-STS for your domain, what you need is an efficient reporting mechanism that would help you detect and respond to issues in email delivery due to problems in TLS encryption at a faster pace. PowerTLS-RPT does exactly that for you!