> MTA-STS is a relatively new standard that allows domain owners such as Comcast to opt in to authenticated encryption for their mail servers. (By default, SMTP traffic between mail servers uses opportunistic encryption, which can be defeated by active attackers to intercept email.) MTA-STS requires the domain owner to duplicate their MX record (the DNS record that lists a domain's mail servers) in a text file served over HTTPS. Sending mail servers, like Alex's, refuse to contact mail servers that aren't listed in the MTA-STS text file. Since HTTPS uses authenticated encryption, the text file can't be altered by active attackers. (In contrast, the MX record is vulnerable to manipulation unless DNSSEC is used, but people don't like DNSSEC which is why MTA-STS was invented.)

Is this just a way of validating the MX record? That is, the public MX record in DNS can't be trusted, but because a cert verifies the identity of the sending mail server, the one they send can be trusted?

If someone is successfully impersonating the sender, what stops them from sending a false MX record. If they aren't impersonators, why not just trust them regardless - why do they need the MX record?

Obviously, I'm missing something.