What is MTA-STS?

MTA-STS (Mail Transfer Agent Strict Transport Security) protects mail in a different way to DANE. STARTTLS on its own is opportunistic: an attacker positioned on the network path can simply strip the STARTTLS announcement, and the connection silently falls back to plaintext with nobody the wiser. MTA-STS closes that gap by publishing a policy - over HTTPS, not DNS - that tells a sending mail server "TLS is mandatory here; if you can't verify it, refuse to deliver".

Two separate pieces have to line up

A DNS TXT record at _mta-sts.yourdomain.com announces that a policy exists and gives it a version id. The policy itself lives at a fixed location, https://mta-sts.yourdomain.com/.well-known/mta-sts.txt - a real subdomain that needs its own valid HTTPS certificate, separate from your mail server's own. Both have to be present, and the policy's own list of MX hosts has to actually match your real MX records - a policy that doesn't cover a host you're actually using protects nothing on that host.

The build-up path

Same principle as DMARC: start in mode: testing, add TLS-RPT reporting so you can see what would have failed, then move to mode: enforce once you're confident. Publishing enforce on day one risks silently dropping mail from senders you didn't account for.