Log in
Checker

MTA-STS checker

Check the MTA-STS of a domain: DNS record, policy at mta-sts.domain, mode, matching mail servers, certificate and TLS-RPT.

What the MTA-STS checker covers

  • DNS record: _mta-sts.your-domain with v=STSv1 and an ID.
  • Policy: the file at https://mta-sts.your-domain/.well-known/mta-sts.txt with mode (testing, enforce or none), lifetime and the allowed mail servers.
  • Matching servers: whether all MX servers of the domain are listed in the policy.
  • Certificate of the site mta-sts.your-domain and, if present, the TLS-RPT record for reports about delivery failures.

Learn more: Setting up MTA-STS and TLS-RPT · MX, STARTTLS and MTA-STS checker

FAQ

What does the MTA-STS checker check?

It reads the DNS record at _mta-sts, retrieves the policy at mta-sts.your-domain and checks mode, lifetime, the named mail servers and the certificate. It also shows whether a TLS-RPT record for reports exists.

What is the difference between testing and enforce?

In testing mode errors are only reported. In enforce mode senders deliver emails only encrypted and only to the named servers.

Do I need MTA-STS?

It is optional but protects the encryption of your incoming email. Start with testing and TLS-RPT and switch to enforce after a few weeks.