Check · Domain & email identity · default severity low
Mail transport security (MTA-STS)
What Kavach checks
MTA-STS tells sending servers to require TLS when delivering mail to you.
Why it matters
Without it, mail to your domain can be downgraded to plaintext in transit or redirected via forged MX records.
How an attacker uses it
- Attacker on the path strips STARTTLS from an incoming mail session.
- With no MTA-STS policy, the sender falls back to plaintext.
How to fix it
Publish _mta-sts TXT and host /.well-known/mta-sts.txt with mode: enforce.
Stack-specific fixes: nginx · Apache · Caddy · Express / Node · Cloudflare
Limitations
This is a read-only observation of publicly reachable configuration at scan time. It can produce false positives/negatives (caching layers, geo-specific responses, bot defences) and does not test application logic or authenticated areas. Rule version 1.