Google’s Gmail, one of the world’s largest e-mail providers, now supports the MTA-STS standard. It will be the “first major email provider” to support the new standard.
As Google announced in its security blog, Gmail will now be supporting the new MTA-STS standard, which is specified in the IETF as RFC 8461. Also supported is the associated SMTP TLS Reporting (RFC 8460), which can be used to report errors to the mail server owner. The MTA-STS standard ensures that the transport encryption between mail servers is reasonably secured.
Until now, communication between mail servers has often been exposed to the danger of man-in-the-middle attacks. MTA-STS is intended to prevent this by requiring other mail servers to verify that the SMTP connection is authenticated using a valid public certificate and that the connection is encrypted using at least TLS 1.2, as described by Google.
Gmail will initially officially support the standard only at a beta stage, but the service will now respect the guidelines for the standard published by other email providers. Corporate customers of Google can also activate MTA-STS for their own domains.
The company hopes that other email providers will also support the standard in the future. So far, Microsoft which handles Outlook.com and Web.de, the popular provider in Germany, has published corresponding guidelines.