Out of 131,024 Korean domains we analysed, only 3 publish an enforcing MTA-STS policy. Email delivery for the other 131,021 domains is still vulnerable to TLS downgrade and MiTM attacks.
In this post, we will go over what MTA-STS is, why it is important, and how it works so you can set it up in your own domain.
Email Encryption is off by default
Mail servers encrypt opportunistically. When the sender sends a HELLO message,
the receiving server replies with a list of everything it supports. That list
might or might not include STARTTLS.
250-mail.example.com
250-PIPELINING
250-SIZE 35882577
250-STARTTLS
250 ENHANCEDSTATUSCODES
If the sender parses a STARTTLS line, it initiates a TLS
connection. Ultimately, the mail message crosses the internet encrypted.
However, when STARTTLS is not sent by the receiver, a sending server falls
back to cleartext.
RFC 3207, the specification that added TLS to SMTP in 2002, names the consequence in its own security section:
RFC 3207 §6: "A man-in-the-middle attack can be launched by deleting the '250 STARTTLS' response from the server."
The attacker deletes one line and passes the rest through, making the sender think the receiver doesn't support TLS.
How MTA-STS works
MTA-STS is defined in RFC 8461.
To configure MTA-STS, a domain has to publish two things.
- A pointer in DNS. A TXT record at
_mta-sts.<domain>carryingv=STSv1and anid. The version string inidmust change whenever the policy changes to indicate to senders that a policy change was made. - A policy over HTTPS. A plain-text file at
https://mta-sts.<domain>/.well-known/mta-sts.txt. This file is used to name the MX hosts allowed to receive your mail.max_agedefines how often senders should re-check the policy, andmodedetermines how the policy is enforced.
mode takes three values:
enforce- a sender that cannot get a valid TLS connection to one of your named MX hosts MUST refuse to deliver the messagetesting- a sender delivers anyway and reports the failurenone- the policy is inert. This is used to retire an old policy.
Reporting is done according to RFC
8460, which defined TLS-RPT. It's a
TXT record at _smtp._tls.<domain>. This address receives daily summaries of
how senders' TLS connections to you ended up: if they failed or not.
A Korean census of MTA-STS enforcement
Curious to find out how prevalent MTA-STS is in Korea, we queried 217,129 .kr
domains, collected from the Tranco list, the Chrome UX Report for Korea, a
top-10-million domain list and the FTC online-seller register (통신판매사업자).
81,957 of them no longer exist, and 4,148 lookups returned SERVFAIL or timed
out. Both groups are excluded, which leaves 131,024 live domains.
| count | |
|---|---|
| Publish an MTA-STS pointer | 20 |
| — whose policy is valid | 6 |
| Publish TLS-RPT | 20 |
| Publish MX | 72,094 |
| DNSSEC-signed | 118 |
That is an astounding 0.015% of the domains. For comparison, URIports' January 2026 scan of the global top million domains found 7,377 publishing a policy — 0.7%, up from 0.3% in 2024.
That means Korea seems have figured out MTA-STS at a rate about 45 times lower than the rest of the world.
The largest Korean domains are no better: none of naver.com, kakao.com,
daum.net, samsung.com, coupang.com, hyundai.com, skt.co.kr, kt.com,
toss.im, shinhan.com or kbstar.com publishes either record. google.com,
gmail.com and microsoft.com publish both.
The six Korean exceptions
Only three Korean domains we found enforce MTA-STS: goodoc.co.kr,
8percent.kr and glitter.kr. Each policy returns HTTP 200 with
mode: enforce, and its mx: lines cover every published MX record.
goodoc.co.kr, for example, lists five mx: lines that match its five MX
records exactly. A sender reading it will refuse to hand over mail to anything
else.
Three more serve a valid policy in mode: testing, which reports failures and
still delivers.
DANE is not the fallback
You might have heard of DANE. It is another way to pin mail transport encryption. In fact, it is stronger: the TLSA record lives in DNSSEC-signed DNS, with no web server in the path.
DANE is great. Nevertheless, it does not help if your MX hostname does not publish a DS record. For instance, if you host email on Google Workspace, DANE is not an option. 8,808 of the domains in our census first-listed MX is a Google host: a TLSA record is unverifiable no matter what.
That said, kr and co.kr both carry DS records at their parent, so a Korean
domain can sign its zone if it wants to. 118 of the 131,024 do.
Cons of implementing MTA-STS
There's a reason most domains don't use MTA-STS. For many, maintaining the setup is too much work for too little in return.
The main concern raised by businesses is that certificate expiration and MX policy misalignment makes senders refuse to deliver your mail. If you don't have mature certification rotation procedures and streamlined MX management policies, you might break your organization's email delivery.
We are curious to know: did you even know MTA-STS existed?
References
- IETF — RFC 8461: SMTP MTA Strict Transport Security (MTA-STS) (September 2018)
- IETF — RFC 8460: SMTP TLS Reporting (September 2018)
- IETF — RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security (February 2002)
- URIports — MTA-STS adoption: three years of steady growth (scan of the top million domains, first week of January 2026)
- Panke — Email spoofing: we tested 10,000+ Korean domains (1 September 2026)
- Panke — Email Security Explained: One Message, Six Checks (21 September 2026)
- Panke — MTA-STS and TLS-RPT census of 217,129
.krdomains, 131,024 live (first-party measurement, 23 September 2026) - Google — Chrome UX Report, country list for Korea, August 2026, via crux-top-lists (CrUX datasets by Google, CC BY 4.0)
Instagram