MTA-STS Checker

Check an MTA-STS policy

MTA-STS makes senders refuse to deliver your mail without a properly authenticated TLS connection. Check the DNS record, the policy host, and the policy itself.

Guide

What the MTA-STS checker tests

SMTP encrypts opportunistically: if TLS fails, most senders quietly deliver in plaintext, and an attacker on the path can force exactly that. MTA-STS (RFC 8461) lets a domain say "only deliver to my MX hosts over TLS with a valid certificate".

  • The DNS record at _mta-sts.your domain: v=STSv1; id=…;, exactly one.
  • The policy host, mta-sts.your domain, must resolve and serve HTTPS with a valid certificate.
  • The policy file at /.well-known/mta-sts.txt: mode (enforce, testing or none), an mx line per mail server, and max_age.
  • MX coverage. In enforce mode, a published MX host that no mx line matches will stop receiving mail from MTA-STS senders.

A browser can only read the policy file if the server sends CORS headers, and most do not. When it cannot, the checker still confirms the host answers over valid HTTPS, and marks the file contents as not verifiable rather than passing them.

FAQ

MTA-STS: common questions

What is MTA-STS?

MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) lets a domain publish a policy requiring sending servers to use TLS with a valid certificate when delivering to its MX hosts. It prevents downgrade attacks that strip encryption from email in transit.

What is the difference between testing and enforce mode?

In testing mode, senders report TLS failures through TLS-RPT but still deliver the mail. In enforce mode, they refuse to deliver unless TLS succeeds. Start with testing, read the reports, then switch to enforce.

Do I need TLS-RPT with MTA-STS?

Strongly recommended. Without TLS-RPT, nobody tells you when senders fail to deliver because of your MTA-STS policy, so a certificate problem on an MX host can silently stop mail.

Why can the checker not read my policy file?

Browsers only let a web page read a file from another site if that site sends CORS headers, and MTA-STS policy hosts usually do not. It does not affect senders at all. The checker still confirms the policy host is reachable over HTTPS with a valid certificate.

Guides

Learn more

  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.