MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) protects mail that is sent to you. You publish a TXT record at '_mta-sts.yourdomain.com' and a policy file at 'https://mta-sts.yourdomain.com/.well-known/mta-sts.txt'. The policy lists your mail servers and says whether senders must use TLS with a valid certificate.

The policy has modes. 'testing' only reports problems, 'enforce' makes senders refuse to deliver without proper TLS, and 'none' turns it off. A companion record, TLS-RPT, gives you an address for reports about failed connections.

For cold email, MTA-STS is a small point. It does not change your inbox placement when you send. It protects the replies that come back to you. It is also easy to break: if the policy file is unreachable or the certificate expires, senders can fail to deliver. Start in 'testing' mode, read the reports, and move to 'enforce' only when they are clean.