TLS uses certificates for encryption, but they aren’t used for verifying the identity of the destination server. This exposes SMTP connections to DNS tampering that can redirect connections to an attacker’s server. Senders have no way to confirm that destination server is the intended email server. The SMTP MTA Strict Transport Security (MTA-STS) standard was developed to ensure that TLS is always used, and to provide a way to for sending servers to refuse to deliver messages to servers that don’t support TLS and have a trusted certificate.

I set this up for a domain that used Exchange Online for the mail.  To tell other MTA-STS mail servers to use this for our domain, I needed to create a file hosted at mta-sts.(domain), .well-known/mta-sts.txt, at mta-sts.(domain).

I created the subdomain https site, with only the .well-known/mta-sts.txt, running only on port 443 to protect this from tampering through other sites on the server.

After DNS for the subdomain (mta-sts.(domain) ) was set up (the A records) then I used Let's Encrypt to create the certificates.  And here's where I found that we really did need port 80 servers too, for the Let's Encrypt process.  I decided to leave these port 80 virtual hosts up as it doesn't really affect anything, and Let's Encrypt needs it every 90 days.

I set up the web servers with /.well-known/mta-sts.txt files, with this:

version: STSv1
mode: testing
mx: *.mail.protection.outlook.com
max_age: 604800

The version should increment with each change.  Because we use EXO, we use the *.mail.protection.outlook.com.

You should start with mode: testing, so you get the reports but nothing is blocked until you are confident that it is functioning correctly.

I created log files for the subdomain, just to keep a better eye on what is happening.  I added a favicon.ico file in the directory, just because it was being asked for by the web requests.

There was concern about server reboots, and what would happen when the mta-sts.txt file wasn't available.  Turns out the RFC accounts for this, if the DNS calls for MTA-STS but the mta-sts.txt file is not available (the policy can't be fetched) when trying to send a message, the sender should continue as though the domain has NOT implemented MTA-STS.

There is also a reporting feature, that tells senders using MTA-STS to send a daily report for their interactions with our server.  This is done through DNS.

TXT Record example:

         _smtp._tls.example.com. 3600 IN TXT v=TLSRPTv1;rua=mailto:This email address is being protected from spambots. You need JavaScript enabled to view it.

 Since we use EXO, they send our mail, and will send out the daily reports to the receiving domains.

More info will be added here as we move through the implementation. Right now it is just in testing.

Microsoft's document for this can be found here.