SMTP REQUIRETLS
REQUIRETLS, defined in RFC 8689, is an SMTP extension that lets the sender of a specific message demand TLS-protected delivery all the way to its final destination, instead of accepting the ordinary STARTTLS behavior of silently falling back to plaintext if encryption can't be negotiated. A sending server adds the REQUIRETLS parameter to the MAIL FROM command for that message; every relay handling it afterward must then either deliver over a TLS session with a certificate it can validate -- checked via DNSSEC or an MTA-STS policy -- or refuse to send the message at all and return a non-delivery notification, rather than quietly downgrading to an unencrypted connection. This differs from MTA-STS, which is a domain publishing a standing policy that applies to all incoming mail; REQUIRETLS instead lets an individual sender enforce the same no-downgrade guarantee on a single outgoing message, which matters when the sender needs that guarantee but can't control, or doesn't know, whether the recipient domain has published an MTA-STS policy of its own. Support is still limited to senders and relays that have specifically implemented the extension.
By AdminKit team, Netbase JSC · Updated