Free MTA-STS Checker
Enter a domain to read its _mta-sts record, fetch its policy file, and see whether senders can require encrypted delivery to every mail server it lists.
Fetching the policy...
Could not check
No MTA-STS record is published for this domain.
- Mode
- Max age (seconds)
- MX patterns
The file was fetched, but it is not a valid MTA-STS policy.
- Covered by the policy Not in the policy
No MX records are published for this domain.
No TLS-RPT record at _smtp._tls, so nobody is told when encrypted delivery fails.
What an MTA-STS Checker Tells You
Mail between servers is encrypted only if both sides agree, and an attacker on the network can strip that agreement away so the message travels in the clear. MTA-STS, defined in RFC 8461, lets a domain state that senders must use verified TLS to reach it, and must not deliver if they cannot.
A deployment has three parts that must agree: a TXT record at _mta-sts, a policy file served over HTTPS, and the MX records the policy has to cover. This MTA-STS checker reads all three, and a break in any of them is named. It also looks for the TLS-RPT record that reports delivery failures.
- Enter the domain that receives the mail, without "www".
- We read the TXT records at _mta-sts and _smtp._tls, and the MX records.
- We fetch the policy file from the mta-sts host over HTTPS.
- Read the verdict, then check each MX host against the policy.
What this check settles
- Whether the policy can be read: a TXT record is no use if senders cannot fetch the policy file behind it.
- Whether it is enforced: only enforce mode tells senders to hold back mail rather than send it unprotected.
- Whether your mail servers are covered: under enforce, a live MX host missing from the policy will not receive mail from senders that apply it.
MTA-STS Policy Modes Explained
The mode field decides what a sender does when it cannot make a verified TLS connection.
| Mode | If TLS fails | What it means | Protection |
|---|---|---|---|
| mode: enforce | Do not deliver | Senders must connect to a listed MX host with a valid certificate, or hold the mail. This is the goal state. | Full |
| mode: testing | Deliver and report | Senders deliver anyway, and send a report if TLS-RPT is set up. Use it to find problems before enforcing. | None yet |
| mode: none | Ignore the policy | No policy applies. Use it to retire MTA-STS cleanly, so senders drop the version they cached. | None |
How to Read the Result
The verdict comes first, followed by each part of the deployment in the order a sender reads it.
The verdict
The headlineWhether the parts fit together. Only an enforced policy that covers every live MX host is reported as enforced.
Record at _mta-sts
The pointerThe TXT record that announces a policy, and its id. Senders compare the id with the one they cached to learn when to fetch again.
Policy file
The rulesThe mode, the max_age and the MX patterns, read from the file at the mta-sts host. If the file could not be read, the reason appears here.
MX hosts and TLS-RPT
The matchEach live MX host checked against the policy patterns, then the record that sends you reports of TLS failures.
What an MTA-STS Policy Looks Like
The TXT record is short: v=STSv1; id=20261106T120000. It sits at _mta-sts.example.com, and the id must change whenever the policy does.
The policy is a plain text file at https://mta-sts.example.com/.well-known/mta-sts.txt, with the lines version, mode, max_age and one mx line per host or pattern. A pattern such as *.mail.example.net matches exactly one label.
How to Roll Out MTA-STS Safely
Senders cache a policy for up to max_age seconds, so a mistake under enforce can outlast the fix. Move in stages.
The usual sequence:
- Confirm each MX host offers TLS with a valid certificate for its own name.
- Publish a TLS-RPT record so failure reports reach you.
- Serve the policy in testing mode with a short max_age, and publish the TXT record.
- Read the reports, then switch to enforce, raise max_age and change the id.
Where MTA-STS Deployments Go Wrong
Most failures come from parts drifting apart after setup. The common ones:
- Editing the policy without changing the id in the TXT record, so senders keep the cached copy until it expires.
- Moving mail provider and forgetting the mx lines, which leaves an enforced policy that excludes your new servers.
- An expired certificate on the mta-sts host. Senders cannot fetch the policy, and renewal for that host is easy to overlook.
- A redirect on the policy URL, often added by a hosting platform. Senders are told not to follow it.
Why MTA-STS Matters
Stop TLS downgrades
Without a policy, an attacker on the path can remove the offer of encryption and read mail in transit, and neither side raises an error.
Avoid self-inflicted bounces
An enforced policy that does not match your MX hosts stops mail from senders that apply it. Finding that here is cheaper than finding it in a queue.
See failed encryption
With TLS-RPT alongside, senders tell you when they could not connect securely, which is otherwise invisible.
Meet security requirements
Encrypted mail transport is a common item on security audits and vendor questionnaires. A clear result is easy evidence.
Who Checks MTA-STS
The same read answers a different question depending on who runs it.
Mail Admins
Confirm the policy still matches the MX hosts after any change to the mail route.
For DNS monitoringSecurity Teams
Verify that inbound mail transport is really enforced, not stuck in testing mode.
For IT & MSPsCompliance Leads
Collect evidence of encrypted mail delivery for an audit or a customer's security review.
For publishersAgencies
Check a client's deployment after a migration, before a stale policy starts stopping their mail.
For agenciesRelated Email Tools
MTA-STS protects the connection. These cover the rest of the mail setup.
List your MX hosts
See every mail server by priority, and confirm each has an address before writing the mx lines.
MX lookupCheck DMARC
MTA-STS protects mail coming in. DMARC protects your name on mail going out.
DMARC checkerFrequently Asked Questions
Common questions about MTA-STS records, policies and how to check them.
What is MTA-STS?
Mail Transfer Agent Strict Transport Security, defined in RFC 8461. It lets a domain tell sending mail servers to use TLS with a valid certificate when delivering to it, and not to fall back to an unencrypted connection.
How do I check my MTA-STS policy?
Enter your domain in the checker above. It reads the TXT record at _mta-sts, fetches the policy file from your mta-sts host, and compares the policy with your live MX records.
Where does the MTA-STS policy file go?
At https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, served over HTTPS with a valid certificate for that hostname. The host needs its own DNS record, and the URL must answer directly with no redirect.
What is the difference between testing and enforce?
In testing mode, senders deliver even if TLS fails, and report the problem if you have TLS-RPT. In enforce mode, they will not deliver unless they can make a verified TLS connection to a host in your policy.
What should max_age be?
It is how long senders may cache the policy, in seconds, up to 31557600. A short value such as 86400 suits testing. Once enforced, many domains use a value of several weeks, commonly 604800 or more.
What does the id in the TXT record do?
It tells senders when the policy has changed. If the id matches the one they cached, they do not fetch the file again. Change it every time you edit the policy, or senders will keep the old version.
Why is my MX host not covered?
Its name does not match any mx line in the policy. A pattern with an asterisk matches exactly one label, so *.example.net covers mail.example.net but not a.mail.example.net. Add the host, then change the id.
What is TLS-RPT?
SMTP TLS Reporting, defined in RFC 8460. A TXT record at _smtp._tls gives an address where senders can send daily reports of failed TLS connections. It is optional, and it is the main way to see problems during a rollout.
Does this test the TLS certificates on my mail servers?
No. It checks the record, the policy file and that each MX host matches the policy. It does not connect to your mail servers, so confirm their certificates separately before moving to enforce.
Does MTA-STS replace DANE?
They solve the same problem in different ways. DANE relies on DNSSEC, while MTA-STS relies on HTTPS and public certificates. A domain can publish both, and senders that support DANE prefer it.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.