MTA-STS (and DANE for mail)
acronymsecurityISP & telecom
A mechanism by which a domain declares that mail sent to it must travel over authenticated TLS, published over HTTPS with a DNS pointer - closing the downgrade gap left by SMTP's opportunistic encryption. DANE solves the same problem using DNSSEC instead.
It is routinely confused with SPF, DKIM and DMARC, and it addresses a different problem entirely: those authenticate the sender, this protects the transport. SMTP's encryption is opportunistic by default, so an attacker in path can strip it and the mail flows in clear. Which of the two mechanisms you can deploy is mostly determined by whether your zone is signed - DANE requires DNSSEC, MTA-STS was designed for domains that do not have it.
Also known as: mta strict transport security, dane, opportunistic tls, downgrade