MTA-STS is a DNS + HTTPS policy that forces mail servers to only deliver email to your domain over encrypted (TLS) connections, preventing downgrade/interception attacks in transit.
Without it, email between servers can silently fall back to unencrypted delivery. It's a newer, less commonly adopted standard than SPF/DKIM/DMARC — presence signals a security-conscious team.
Policy file hosted at the wrong path (/.well-known/mta-sts.txt), mismatched max_age causing stale policy caching, TXT record pointing to a policy that was never deployed.
Run a free, instant audit of MTA-STS and every other authentication record on any domain.
Run a Free MTA-STS CheckLow adoption rate makes this a useful differentiator in positioning — "we check things most tools don't even look for."