Blog Post

Exchange Team Blog
7 MIN READ

Introducing MTA-STS for Exchange Online

The_Exchange_Team's avatar
The_Exchange_Team
Icon for Microsoft rankMicrosoft
Feb 02, 2022
The SMTP protocol isn’t secure and wasn’t designed to be. Email sent in the early days of the Internet were the digital equivalent of sending a postcard through the postal system. Eventually, Transpo...
Updated Jul 20, 2022
Version 4.0
announcements
exchange online
security
transport
ChrisAtMaf's avatar
ChrisAtMaf
Steel Contributor
May 10, 2023

Will Microsoft support MTA-STS for the *.onmicrosoft.com fallback domains so that we can enforce TLS for email submissions e.g. from on-premises email servers?

We tried doing this ourselves but we would need to obtain an SSL certificate for mta-sts.<tenantdomainname>.onmicrosoft.com - this is not possible to obtain from our external certificate authority (e.g. Azure CDN) since we cannnot create CNAME records via the https://admin.microsoft.com/


However wouldn't it make more sense for Microsoft to publish a default mta-sts.<tenantdomainname>.onmicrosoft.com for ALL domains including TXT records which would improve tenant security for everyone? Can't see why you wouldn't want to do this.