How To Configure MTA-STS For Email Security

At first glance, sending emails seems easy - just type the message and hit Send. Yet, the underlying processes are not as straightforward. Introduced for this reason is a more recent technology called Mail Transfer Agent – Strict Transport Security (MTA-STS). 

MTA-STS technology strives to establish a Transport Layer Security (TLS) connection between email servers to guarantee the consistent use of TLS for mail transport. The certainty of using TLS for mail transfer does not eliminate but rather decreases the risk of external threats. 

What is MTA-STS?

MTA-STS's purpose is to ensure that mail servers utilize a secure TLS connection while sending emails to you. It expresses endorsement for a TLS connection, which ensures it is consistently used for the designated domain. MTA-STS includes a specified policy and a DNS TXT record that work together to authenticate a TLS connection.

By setting the policy, you have the ability to decide if emails that are not sent via a TLS connection should be denied or delivered to the recipient's inbox. Furthermore, similar to DMARC reporting, you have the ability to set up MTA-STS reports that provide information on unsecured incoming emails. TLS Reporting is the term used for this. 

What is the Purpose of MTA-STS? 

MTA-STS verifies to the mail server that it is not interacting with a fake server but with the legitimate SMTP server authorized to send the email. This would also guarantee that the email's contents remain unaltered, as confirmed by DKIM's digital signature. Although no security measure is completely guaranteed, combining MTA-STS with TLS reporting provides an additional level of security.

The previous method used instead of MTA-STS, known as STARTTLS, did not consistently guarantee TLS encryption for every connection, providing opportunities for attackers. MTA-STS solves that problem by stopping downgrade attacks. Additionally, it prevents Man-in-the-Middle attacks and maintains the privacy and security of the email contents and sender.

Moreover, it also deals with the problem of expired TLS certificates. Conversely, TLS reporting also provides a couple of advantages. TLS reporting provides information on the status of email connections, whether they were successful or unsuccessful, and assists in identifying problems associated with TLS negotiation. 

MTA-STS Prerequisites 

While MTA-STS is excellent for email security, not all users are able to set it up for their domain. There are specific requirements that the mail server must meet in order to configure MTA-STS, including the following: 

A server capable of receiving mail transfers through a TLS connection. 

A minimum of TLS version 1.2 

TLS certificates must meet the following requirements: 

Stay current / Keep abreast of the latest developments 

Use the identical servers that are listed in your MX records. 

Gain trust from a root certificate authority. 

If your email server meets these criteria, you can set up MTA-STS on it to improve your email security. 

Steps to Set Up MTA-STS DNS Records

As previously stated, MTA-STS consisted of a DNS record with two parts. One states that the server is compatible with TLS connections, while the other indicates the destination for TLS reports if desired. The previous DNS record that indicates the server's support for TLS connections is called: _mta-sts.yourdomain.com can be rewritten as yourdomain.com's _mta-sts. The value of "_mta.sts" is determined by the following tags: 

Description of the tag 

Defines the version of MTA-STS. The current valid version is only "STSv1" right now. 

The ID is a combination of letters and numbers, with a maximum length of 32 characters, utilized for monitoring policies. If your email service provider doesn't offer it, you can create one yourself using a unique number or utilize an MTA-STS record generator. 

Explanation of MTA-STS DNS RecordTag. 

The naming convention for the second MTA-STS DNS record designed for TLS reporting is as follows: 

_smtp.tls.yourdomain.com can be rewritten as _smtp.tls.yourdomain.com. 

"Tags for defining values of "smtp.tls" include:" 

Description of tag 

Specifies the version of the TLS report. The current legitimate version is "TLSRPTv1". 

The email address for receiving TLS reports is specified by the "rua" tag. It is preceded by "mailto:" followed by the actual email address. 

Description of tag for MTA-STS DNS Record for TLS reporting 

To set them up on your DNS, follow these straightforward instructions. Please be aware that the DNS server settings may differ for each individual user, thus the instructions and visual aids provided may not be identical for everyone. However, the same reasoning still holds true. 

Access your DNS server with administrator privileges. 

Select "Add Record" followed by selecting "Add TXT Record". 

Create an additional TXT record. 

Provide your domain name to create the MTA-STS record name. 

Promotional messages 

_mta-sts.yourdomain.com translates to the domain name _mta-sts.yourdomain.com. 

Input the name of the MTA-STS record. 

Next, insert the variables into the provided syntax and then copy and paste it into the Record field. 

Make sure to substitute [YourID] with an ID given by your email service provider, or create your own. 

v=STSv1; id=[YourID] 

Provide the value for the MTA-STS record. 

If you want, you can change the Time To Live (TTL) duration, which determines how long the record will remain cached.

After completing the task, press the Save Record button. 

[Optional] You can go through the same process as described above and apply the specified values to generate a TLS report DNS record using the provided TXT file name. 

Full Name: _smtp.tls.yourdomain.com is the same as smtp.tls.yourdomain.com 

Importance: 

v=TLSRPv1; rua=mailto:[EmailAddress] 

Set up MTA-STS TLS Reporting DNS record. 

Press "Save Record" once finished. 

By following these steps, you will have effectively set up the MTA-STS records for your domain. Nevertheless, it is still necessary to set up the MTA-STS policy on the server. 

Conclusion

By now, you probably realize that email communication requires various mechanisms, protocols, and processes. We have previously talked about the authentication methods implemented, such as SPF, DKIM, and DMARC. Brand Indicator Message Identification (BIMI) is another authentication standard for recipients that includes brand logos in legitimate emails.

MTA-STS offers a secure channel for emails to prevent tampering or interception by malicious actors. These processes work together to ensure you receive genuine emails and prevent spam and spoofed emails from reaching you or your organization, decreasing the likelihood of phishing attempts.