Log in
Checker

MX, STARTTLS and MTA-STS checker

Check a domain's MX records, the encryption and certificates of its mail servers and its MTA-STS policy.

What the MX and TLS checker checks

  • MX records: which servers accept email for the domain.
  • STARTTLS: whether every mail server offers encryption, whether the certificate is trusted, matches the server name and how long it remains valid. We briefly connect via SMTP and close the connection without sending an email.
  • MTA-STS: whether the domain enforces encrypted delivery, whether the policy can be retrieved and whether it includes all MX servers.

Learn more: Setting up MTA-STS and TLS-RPT

FAQ

How do I check my domain's MX records?

Enter your domain. We show all mail servers with priority and check whether they are reachable, offer STARTTLS and have a valid certificate.

What is MTA-STS?

MTA-STS specifies that email to your domain is only delivered encrypted and only to the listed servers. That way nobody can switch off encryption along the way.

Why is an expired certificate on the mail server a problem?

With MTA-STS in enforce mode, email is then not delivered at all; without MTA-STS security drops. Many senders log such errors in TLS reports.