MTA-STS Checker
Verify MTA-STS DNS records and HTTPS policy files to ensure encrypted mail delivery.
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) tells other mail servers that inbound mail to your domain must be delivered over an encrypted, certificate-validated TLS connection — not opportunistic TLS, which silently falls back to plaintext if the connection is downgraded or intercepted. It works through two parts: a DNS TXT record signaling the policy exists, and an HTTPS-hosted policy file atmta-sts.yourdomain.com/.well-known/mta-sts.txt spelling out the details.
How to read the result
The checker verifies both parts independently. The DNS record confirms the domain has opted in; the policy file supplies the actual rules — enforce,testing, or none mode, the list of MX hosts allowed to receive mail, and a max-age controlling how long other servers should cache the policy before re-checking it.
Common failure causes
- The DNS record exists but the policy file is missing, unreachable, or served without a valid HTTPS certificate.
- The MX hosts listed in the policy file don't match the domain's actual MX records after an infrastructure change.
- The policy has been left in testing mode indefinitely instead of moving to enforce once validated.
- The certificate on the mta-sts subdomain expires and isn't renewed, breaking the policy fetch entirely.
Frequently asked questions
What is the difference between enforce and testing mode?
In "testing" mode, sending servers that support MTA-STS report on TLS failures without actually blocking delivery — it is meant for validating the policy before committing to it. In "enforce" mode, mail that can't be delivered over a matching, valid TLS connection is held or bounced rather than falling back to plaintext.
How does MTA-STS relate to DANE?
Both force TLS for inbound mail, but they use different trust models. DANE relies on DNSSEC and TLSA records to bind a certificate directly to DNS. MTA-STS relies on the public CA system and an HTTPS-hosted policy file, so it works without DNSSEC — which makes it easier to deploy, at the cost of trusting the same CA infrastructure the web relies on.
Does MTA-STS replace TLS everywhere?
No — it only governs the connection between mail servers exchanging your inbound mail (SMTP), not the connection between a mail client and its server, and not outbound mail you send. It closes one specific gap: a downgrade or interception attack on the MX path.
Keep an eye on this automatically
A one-off check tells you how things look right now. DMARC.WS collects your aggregate reports continuously, shows you which senders are failing authentication, and alerts you when something changes.
Free plan includes 5 domains. No card required.