SMTP Strict Transport Security

> That forged policy would, by necessity, include an a field similarly
> doctored to direct the client to an attacker-controlled server when
> authenticating the policy.

This is prevented by the following requirement (from section 3.3 of the linked draft):

| [...], and MUST be served from an HTTPS endpoint at the domain
| matching that of the recipient domain.

Maybe „matching“ could do with a better definition (does https://infected.example.com/... „match“ for example.com?), but it’s not as easy as pointing the client to https://evil.org/ outright.

The real attack scenario, and the reason, why SSTS, like HSTS, relies on caching, is the MITM attacker filtering DNS requests, so that the client never gets the TXT record. If the attacker is able to do this outright, the client will never learn the server’s SSTS policy. But once an unfiltered connection is made, the policy is loaded, verified, and cached … which makes subsequent attacks of this type fail.