MTA-STS record

MTA-STS Checker

Check whether your domain publishes an MTA-STS policy - the mechanism that forces sending servers to use encrypted (TLS) connections to your mail servers.

One record is only part of it

MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC and BIMI all decide together whether your mail is trusted. The full report reads every one of them and hands you the fix.

Run the full domain check

About these results

This tool reads your domain's public _mta-sts TXT record and fetches the policy file over HTTPS at mta-sts.yourdomain/.well-known/mta-sts.txt at the moment of the check. Results reflect current public data and can be affected by caching and propagation (up to 24-48 hours). Guidance is general and not a substitute for your provider's official instructions. We don't store the domains you check.

Reference

How MTA-STS works

What the record is for, how to read the result, and what to do about each problem.

What is MTA-STS?

MTA-STS lets your domain tell other mail servers to always deliver over a valid, encrypted TLS connection - protecting against downgrade and interception attacks.

How it works

A TXT record at _mta-sts.yourdomain plus a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt listing your MX hosts and a mode.

Common problems and fixes

Not configured: publish the TXT record and host the policy file over valid HTTPS.
Policy unreachable: senders ignore MTA-STS if the file can't be fetched over trusted HTTPS.
Stuck in testing: switch to mode: enforce once TLS-RPT looks clean.

Questions

Frequently asked

What is MTA-STS?

MTA-STS lets your domain require that other servers deliver mail to you over a valid TLS connection. It's a _mta-sts TXT record plus a policy file hosted over HTTPS.

testing vs enforce mode?

In testing mode senders report TLS failures but still deliver; in enforce mode they refuse insecure delivery. Start in testing, review TLS-RPT reports, then enforce.

Related checks