Red Sift’s definitive guide to email security
MTA-STS
What is MTA-STS?
Mail Transfer Agent Strict Transport Security (MTA-STS) is a standard that enables the encryption of messages being sent between two mail servers. It specifies to sending servers that emails can only be sent over a Transport Layer Security (TLS) encrypted connection which prevents emails from being intercepted by cybercriminals. MTA-STS adoption has grown significantly, with organizations in 2026 recognizing transport layer security as essential for protecting email in transit.
Why do you need MTA-STS?
The Simple Mail Transfer Protocol (SMTP) alone does not provide security, making it vulnerable to malicious attacks such as man-in-the-middle attacks. A man-in-the-middle attack is where communication between two servers is intercepted and possibly changed without detection by the recipient.
In addition, encryption is optional in SMTP, which means that emails can be sent in plaintext. If a plaintext email was intercepted in transit, it could easily be read and manipulated. Without MTA-STS, an attacker can intercept the communication and force the sending service to send the message in plain text.
By enabling MTA-STS, a TLS connection is required which ensures encryption and keeps your emails private. In 2026, MTA-STS has become a standard security control for organizations handling sensitive communications. The MTA-STS standard is so critical to improving the security of SMTP that it has widespread support among major mail service providers such as Google and Microsoft.
For more technical details, visit the MTA-STS and TLS chapter in our Technical Configuration Guide.
Frequently asked questions: Email security guide
All email security measures (apart from DMARC) are ineffective at spotting a malicious email when it appears to come from a legitimate domain. This is because of a flaw in Simple Mail Transfer Protocol (SMTP). In October 2008, the Network Working Group officially labelled it 'inherently insecure', stating that anyone could impersonate a domain and use it to send fraudulent emails pretending to be the domain owner.
Anyone with a very basic knowledge of coding can learn the steps required to impersonate someone's email identity through a quick Google search. The result is an email that looks legitimate without typical phishing indicators. With 3.4 billion phishing emails sent every day, email systems remain the prime target for cybercriminals.
SPF (Sender Policy Framework) verifies that an email is sent from an IP address authorised by the sending domain's SPF record through a DNS TXT record listing authorised mail servers.
DKIM (DomainKeys Identified Mail) uses a cryptographic signature, validated via a public key in DNS, to confirm that the email's content hasn't been altered and comes from an authorised domain. Both are essential to email security, but neither prevents exact impersonation.
While the protocols tell the recipient who the email is from, the recipient has no instruction to act on this knowledge. Major inbox providers now require SPF and DKIM for bulk email senders in 2026.
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It's an outbound email security protocol that allows domain owners to tell receiving inboxes to reject spoof emails. DMARC works by combining the results of SPF and DKIM to determine if your email is authentic and authorised.
The DMARC policy (defined by the "p=" tag in your DNS record) then tells recipient servers what to do with it. DMARC stops exact domain impersonation by instructing recipient servers not to accept any emails which aren't authenticated. In 2026, DMARC has become a standard requirement for organisations sending bulk email.
The SPF specification limits DNS lookups to 10. If your SPF record exceeds this, SPF will fail. The SPF mechanisms counted are: a, ptr, mx, include, redirect and exists. In reality, 10 lookups aren't enough because most businesses use multiple email-sending tools.
G Suite alone takes up 4 DNS lookups, add in HubSpot for marketing which uses 7 lookups and you're already over the limit. As soon as you go over 10 SPF lookups, your email traffic will begin to randomly fail validation. This is why organisations in 2026 are shifting to dynamic SPF management rather than trying to manually maintain flattened records.
Mail Transfer Agent Strict Transport Security (MTA-STS) is a standard that enables the encryption of messages being sent between two mail servers. It specifies that emails can only be sent over a Transport Layer Security (TLS) encrypted connection which prevents interception by cybercriminals. SMTP alone does not provide security, making it vulnerable to man-in-the-middle attacks where communication is intercepted and possibly changed.
Additionally, encryption is optional in SMTP, meaning emails can be sent in plaintext. Without MTA-STS, an attacker can intercept the communication and force the message to be sent in plain text. In 2026, MTA-STS has become a standard security control for organisations handling sensitive communications.
By implementing DMARC you benefit from stopping phishing attempts that appear to come from you, stronger customer trust, reduced cyber risk and compliance with bulk sender requirements from Google, Yahoo and Microsoft.
DMARC strengthens compliance with PCI DSS 4.0 and enhances overall organisational resilience against evolving cyber threats. Once at p=reject (enforcement), DMARC blocks vendor fraud, account takeovers, and email spoofing by stopping bad actors from using your domain to send phishing emails and carry out Business Email Compromise (BEC). According to Verizon's 2025 Data Breach Investigations Report, BEC attacks constitute more than 17-22% of all Social Engineering incidents.
Red Sift OnDMARC accelerates the DMARC journey with automated sender discovery, prescriptive fixes, anomaly detection, and role-based access for global teams. By 2026, leading platforms enable enterprises to reach p=reject enforcement in 6-8 weeks rather than the six month timelines once typical.
One of the most commonly reported benefits of OnDMARC is an average time of 6-8 weeks to reach full enforcement. The platform's powerful automation continuously analyses what's going on across your domain, surfacing alerts for where and how to make necessary changes. Within 24 hours of adding your unique DMARC record to DNS, OnDMARC begins to analyse and display DMARC reports in clear dashboards.
Major email providers including Microsoft, Google, and Yahoo now mandate DMARC for bulk senders (organisations sending 5,000+ emails per day) as of 2024-2025, and these requirements have become standard in 2026.
Beyond inbox provider requirements, certain industries and government regulations are moving toward mandating DMARC. U.S. federal agencies are required to use DMARC, as are DORA regulated payment processors. Additionally, DMARC implementation strengthens compliance with regulations including PCI DSS 4.0, GDPR, and NIS2. For cybersecurity, email security and IT teams, ensuring your organisation's email security aligns with international best practices and requirements is essential.