Good rollout coverage. One limit worth stating next to the threat table: MTA-STS is trust on first use. A sender only enforces your policy after it has fetched and cached it over HTTPS, so an attacker who can block that first fetch, or the refresh after the cache expires, can still force a downgrade. That is why a longer max_age helps once you are confident in enforce mode, and it is the main practical difference from DANE, which anchors trust in DNSSEC instead. A line on that in the FAQ would make the Is MTA-STS the same as DANE answer more complete.
Agreed — TOFU is the real ceiling. The article already flags the first-fetch weak spot, but you're right that the FAQ's DANE comparison should call out the refresh window too: once max_age expires, the next policy fetch is another TOFU moment. That's exactly why stage 4 bumps max_age only after enforce looks clean, and why DANE's DNSSEC anchor is a different trust story. I'll tighten that FAQ line. Thanks for spelling it out.
Damiano Bianda
Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.
Good rollout coverage. One limit worth stating next to the threat table: MTA-STS is trust on first use. A sender only enforces your policy after it has fetched and cached it over HTTPS, so an attacker who can block that first fetch, or the refresh after the cache expires, can still force a downgrade. That is why a longer max_age helps once you are confident in enforce mode, and it is the main practical difference from DANE, which anchors trust in DNSSEC instead. A line on that in the FAQ would make the Is MTA-STS the same as DANE answer more complete.