The downgrade problem, in one line
SMTP TLS is negotiated per connection; a machine-in-the-middle who strips STARTTLS gets plaintext, because the sender's fallback is 'deliver anyway'. Everything here exists to turn 'prefer TLS' into 'REQUIRE TLS, verified'.
The mechanisms
- MTA-STS (you publish): a policy (DNS record + HTTPS-served policy file) telling senders 'only deliver to these MX hosts, over TLS, with valid certs — enforce'. HTTPS distribution sidesteps the need for DNSSEC. Exchange Online RESPECTS others' MTA-STS on send and SUPPORTS your inbound policy.
- TLS-RPT (you publish an address): receivers send you daily JSON reports of TLS negotiation successes/failures toward your domain — the monitoring half nobody deploys and everyone needs; it catches the broken-cert-on-MX day BEFORE partners phone.
- DANE for SMTP (DNSSEC-anchored cert pinning in DNS): the stronger, DNSSEC-dependent alternative — Exchange Online has grown support across recent years (outbound verification and inbound per-tenant enablement in preview/rollout waves). If your DNS estate has DNSSEC, DANE is the endgame; if not, MTA-STS is the practical enforcement today.
Deployment order (mirrors the DMARC journey)
TLS-RPT first (visibility, zero risk) → MTA-STS in testing mode → read reports for stragglers (that one partner relaying via a 2012 box) → enforce. For inbound-DANE ambitions: DNSSEC on the domain is the prerequisite conversation, and it's a registrar/DNS-provider project before it's an Exchange one.
What to watch (proofs)
- Your published state: the _mta-sts and _smtp._tls records + the policy file over HTTPS — versioned like SPF/DKIM/DMARC (one quarterly snapshot of all five).
- The reports themselves: TLS-RPT JSON (any analyser) — failure sources and counts; the day a partner's sender can't negotiate, this is where it shows first.
- Enforcement reality: your MX certs' validity/runway (the trio of cert-expiry lessons across this site applies to MX too).
- Outbound respect: trace/NDR text when sending to MTA-STS-enforcing domains with TLS trouble — Exchange declining downgrade is the system working; read it as such.