Of the 10,000 most-visited domains on the web, 97.8% have no MTA-STS policy at all. Not misconfigured. Not weak. Just absent. I scanned the Tranco top 10,000 in June and MTA-STS is the single most-ignored email-security control I measured, by a wide margin. For comparison, in the same scan a third of those domains had no DMARC, which people already treat as a problem worth writing about. Missing MTA-STS is nearly three times as common as that, and almost nobody mentions it. What M...