MTA-STS（邮件传输代理严格传输安全）
Embed This Widget
Add the script tag and a data attribute to embed this widget.
Embed via iframe for maximum compatibility.
<iframe src="https://tldfyi.com/iframe/glossary/mta-sts/" width="420" height="400" frameborder="0" style="border:0;border-radius:10px;max-width:100%" loading="lazy"></iframe>Paste this URL in WordPress, Medium, or any oEmbed-compatible platform.
https://tldfyi.com/glossary/mta-sts/Add a dynamic SVG badge to your README or docs.
[](https://tldfyi.com/glossary/mta-sts/)Use the native HTML custom element.
MTA-STS（RFC 8461）是一种机制，允许邮件域声明一项策略，要求到其邮件服务器的入站SMTP连接使用TLS并提供有效[[ssl-tls|证书]]。该策略通过指向HTTPS服务的策略文件的DNS TXT记录发布，支持MTA-STS的发送邮件服务器在投递邮件前会获取并缓存该策略。MTA-STS可防止机会性TLS降级攻击，并作为不需要[[dnssec|DNSSEC]]的替代方案补充[[dane|DANE]]。将MTA-STS与[[dmarc|DMARC]]和[[spf-record|SPF]]结合实施，可显著强化组织的电子邮件安全态势。
示例
Google publishes an MTA-STS policy for gmail.com; external mail servers that support MTA-STS will refuse to deliver email to Gmail over a plaintext or self-signed TLS connection.