If we look at gmail's current policy: version: STSv1 mode: testing mx: gmail-smtp-in.l.google.com mx: *.gmail-smtp-in.l.google.com max_age: 86400 Then if someb

If we look at gmail's current policy: version: STSv1 mode: testing mx: gmail-smtp-in.l.google.com mx: *.gmail-smtp-in.l.google.com max_age: 86400 Then if somebody can take over the domain google.com they immediately start receiving mail for gmail.com. If you can take over gmail.com you may have to wait for a day. The classical argument against DNSSEC (the governments are in control) applies just as much to MTA-STA.