Two records, only one holds the policy
Mail servers negotiate encryption by asking whether the other side supports it. Anyone able to strip that offer from the conversation, or redirect the lookup to their own server, gets the mail in the clear — and neither end notices.
A published policy fixes this by telling senders what to require. Where that policy lives is the part people get wrong.
Put the policy where a sender can trust it.
Components — tap one, then tap a slot on the diagram
?Publish the policy in the wrong place and an attacker who can tamper with the lookup can tamper with the policy too.
Outside every boundary: Sending server, A DNS record (says a policy exists), Your mail servers, an empty slot for the where the rules live Connections: Sending server controls A DNS record — is there a policy? (step 1) Sending server calls where the rules live — fetch the rules (step 2) where the rules live controls Your mail servers — which servers, and require encryption (step 3)
Sending server
A DNS recordsays a policy exists
Your mail servers