MTA-STS: force TLS for inbound mail
MTA-STS is how you insist that other mail servers speak TLS when they deliver to you — not plaintext when an attacker strips STARTTLS.
US search interest: “mta-sts” ~590/mo (DataForSEO).
What CrowWake checks
TXT at _mta-sts.domain plus https://mta-sts.domain/.well-known/mta-sts.txt. Both present → ok; one missing → warn.
Why it matters
Together with TLS-RPT it closes a real downgrade class for inbound mail. Optional, but increasingly expected for serious brands.
If CrowWake crows
Follow your ESP or mail host’s MTA-STS guide: DNS id record + hosted policy + reporting via TLS-RPT.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.