MTA-STS lets your domain require that other servers deliver mail to you over a valid TLS connection. It's a _mta-sts TXT record plus a policy file hosted over HTTPS.

testing vs enforce mode?

In testing mode senders report TLS failures but still deliver; in enforce mode they refuse insecure delivery. Start in testing, review TLS-RPT reports, then enforce.

Mail7

MTA-STS Checker

Check whether your domain publishes an MTA-STS policy - the mechanism that forces sending servers to use encrypted (TLS) connections to your mail servers.

Want the full picture - MX, SPF, DKIM, DMARC and more?

Run a full Domain Check

About these results

This tool reads your domain's public _mta-sts TXT record and fetches the policy file over HTTPS at mta-sts.yourdomain/.well-known/mta-sts.txt at the moment of the check. Results reflect current public data and can be affected by caching and propagation (up to 24-48 hours). Guidance is general and not a substitute for your provider's official instructions. We don't store the domains you check.

What is MTA-STS?

MTA-STS lets your domain tell other mail servers to always deliver over a valid, encrypted TLS connection - protecting against downgrade and interception attacks.

How it works

A TXT record at _mta-sts.yourdomain plus a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt listing your MX hosts and a mode.

Common problems and fixes

Not configured: publish the TXT record and host the policy file over valid HTTPS.
Policy unreachable: senders ignore MTA-STS if the file can't be fetched over trusted HTTPS.
Stuck in testing: switch to mode: enforce once TLS-RPT looks clean.

Related checks: Full domain check SPF DKIM DMARC MX lookup TLS-RPT DNSSEC BIMI