Controls/EDCA-TLS-025.json

{
  "id": "EDCA-TLS-025",
  "title": "Accepted domains publish valid MTA-STS policies",
  "description": "MTA-STS (Mail Transfer Agent Strict Transport Security) allows a domain to publish a requirement that sending mail servers must use TLS when delivering to that domain and must validate the certificate; the policy is served over HTTPS and cached by senders so that future deliveries enforce TLS even if DNS is temporarily manipulated. Each accepted domain MUST publish a valid MTA-STS DNS TXT record and host a reachable HTTPS policy file with STSv1 syntax.",
  "verify": true,
  "subject": "Organization",
  "category": "Transport Security",
  "severity": "Medium",
  "severityWeight": 7,
  "frameworks": [
    "Best Practice",
    "NIS2",
    "CISA",
    "ISM"
  ],
  "references": [
    {
      "name": "RFC 8461 - SMTP MTA Strict Transport Security (MTA-STS)",
      "url": "https://www.rfc-editor.org/rfc/rfc8461"
    },
    {
      "name": "ENISA / NIS2 Directive (EU) 2022/2555 - Article 21(2)(e): secure email transport and mail flow integrity - Section 6.7, 6.3, 6.4, 3.2-3.4",
      "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj"
    },
    {
      "name": "CISA BOD 18-01 (2017): Enhance Email and Web Security - enforce email transport security via policy",
      "url": "https://www.cisa.gov/binding-operational-directive-18-01"
    },
    {
      "name": "ISM: Guidelines for Email (ISM-1589)",
      "url": "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-for-email"
    }
  ],
  "remediation": {
    "automatable": false,
    "description": "Publish _mta-sts TXT with v=STSv1; id=... and host a valid policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.",
    "scriptTemplate": "# DNS + web hosting change required for MTA-STS policy publication."
  },
  "considerations": "MTA-STS in enforce mode causes sending servers that cannot verify TLS to bounce messages rather than deliver them in plaintext. Always begin with mode=testing and monitor policy evaluation before switching to enforce. The max_age TTL determines how long senders cache the policy - a shorter TTL allows faster rollback but reduces caching efficiency.",
  "roles": [
    "Mailbox"
  ]
}