Trust beats tactics™

Transport security

MTA-STS & TLS-RPT Checker

Enter a domain. We resolve the _mta-sts and _smtp._tls TXT records, fetch the policy file at the well-known URL, look up MX records, and cross-check every MX host against the policy.

New to MTA-STS? Read What is MTA-STS in the Email Almanac.

We resolve four signals server side: the _mta-sts DNS record, the policy file at the well-known URL, the _smtp._tls record, and MX records.

How this tool works

What this tool checks

  1. 1

    The _mta-sts DNS record

    We resolve the TXT record at _mta-sts.your-domain and confirm v=STSv1 plus the policy id. Without this record, senders never discover your policy.

  2. 2

    The policy file

    We fetch https://mta-sts.your-domain/.well-known/mta-sts.txt and validate version, mode, mx patterns and max_age. The web server must serve it over valid TLS.

  3. 3

    The _smtp._tls DNS record

    We resolve the TLS-RPT TXT record. Without it you never see reports of TLS failures and policy violations.

  4. 4

    The MX cross-check

    We pull the domain's MX hosts and verify each one matches at least one mx: pattern in the policy. Uncovered hosts get rejected when the mode is enforce.

Four signals, all needed

  • _mta-sts
  • Policy file
  • _smtp._tls
  • MX match

Missing any one leaves a gap that downgrade attackers can exploit.

The safe order

  1. testingFix every flagged item
  2. enforceThen switch

When to use it

Reach for it in these moments

  • First deploy

    Run the checker right after you publish the DNS record and policy file. Start in testing mode, fix every flagged item, then switch to enforce.

  • After MX changes

    Any time you add or change MX hosts, re-run the tool. A new MX host that no policy pattern covers will cause hard delivery failures in enforce mode.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch. Cleaning a list does not fix a DNS record, so if this check found a problem, start here.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Run a check, then email it

  • Your setup is one half. Your list is the other.

    A record that passes proves the mail is yours. Mailbox providers also judge you on who you send to. Clean your first 1,000 addresses free.

    Clean your first 1,000 free