MTA-STS and TLS-RPT: enforce encrypted email

DMARC is about authentication: is the sender real? MTA-STS is about transport: is the mail delivered encrypted? Together they close two different attack vectors.

MTA-STS

MTA-STS publishes a policy that forces sending servers to use TLS to your mail servers — and to refuse the connection if encryption fails. This prevents downgrade attacks.

TLS-RPT

TLS-RPT lets recipients report when an encrypted connection failed. You see transport problems before they cost you mail. DMARC-IT generates both records and processes the TLS reports.