MTA-STS and DNS hygiene

Once SPF, DKIM, and DMARC are in place, a second tier of DNS signals hardens mail transport and certificate trust. VectoraPoint scores MTA-STS, TLS-RPT, DNSSEC, and CAA for a few points each — small individually, telling as a set.

MTA-STS and TLS reporting

MTA-STS publishes a policy (DNS TXT plus a HTTPS .well-known/mta-sts.txt) so senders prefer TLS to your MX hosts. TLS-RPT (_smtp._tls) gives you failure reports when TLS negotiation fails. Across our 100-domain cohort, MTA-STS was nearly absent even where DMARC was strong — an open hygiene gap for teams that already “solved” authentication.

DNSSEC and CAA

DNSSEC (DS / AD flag) authenticates DNS answers; CAA constrains which certificate authorities may issue for your domain. Neither replaces mail auth, but both reduce classes of DNS and mis-issuance risk that sit next to email operations.

Posture, not placement

This audit cannot see inbox placement or sender reputation. A domain with no MX scores near zero for email for a good reason: it does not send mail. Treat the Email axis as configuration posture you can verify in DNS, then validate delivery with your ESP’s own tools.

Compare your Email Delivery score with SEO and AI Citation on VectoraPoint — email is often near-solved while GEO still has room to move.