Measured data, July 9, 2026

Good idea, poor adoption: MTA-STS among the Fortune 500

MTA-STS was built to fix a blunt problem: without it, anyone on the wire can strip STARTTLS and read mail in transit. The remedy is simple. A DNS record says a policy exists; a file at https://mta-sts.<domain>/.well-known/mta-sts.txt tells senders to deliver only over authenticated TLS. We checked every Fortune 500 company. The idea holds up. The adoption does not.

01 Published vs. enforcing

Published is rare. Enforced is rarer.

11/500 companies

serve an MTA-STS policy

11 of the 500 companies publish a valid policy file at the well-known location.

45%

5/11 of those

are in enforce mode

The rest sit in testing mode, collecting reports but never actually rejecting an unencrypted delivery.

companies out of 500 actually enforce TLS on inbound mail. Good idea, poor adoption, in one number.

02 The deployment funnel

Where adoption stalls, across all 500

Advertises an _mta-sts DNS record2.4% · 12

Serves a valid policy file2.2% · 11

Enforces TLS (mode: enforce)1.0% · 5

03 Modes and reporting

Even the adopters hesitate

Among the few who deploy, most stop at testing: collect failure reports, never reject unencrypted delivery. TLS-RPT, the companion reporting record, shows up more than twice as often as MTA-STS itself. Plenty of appetite for telemetry; little appetite to enforce.

Policy modes of 11 policies

testing

enforce

Reporting adoption of 500 surveyed

TLS-RPT configured

MTA-STS DNS record

companies publish TLS-RPT without a working MTA-STS policy to back it up. They want the reports. They do not want to bounce mail.

04 The roll call

12 companies in on the idea

Every Fortune 500 domain with an MTA-STS footprint. 5 enforce, 6 test without enforcing, and any tagged record only advertised a DNS record but never served a policy.

dana.com

enforce tls-rpt

mode · enforce

mx · 1 host

max_age · 604800s

kbr.com

enforce tls-rpt

mode · enforce

mx · 1 host

max_age · 604800s

microsoft.com

enforce tls-rpt