MTA-STS Checker
Check that MTA-STS is set up correctly, so other mail servers only deliver to you over verified, encrypted connections.
Free, no account needed.
What this check looks at
- The _mta-sts TXT record and its id= value.
- The policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, including its certificate.
- The mode (testing, enforce or none), max_age, and whether every MX server is covered by an mx: line.
Why use MTA-STS
STARTTLS on its own can be stripped by an attacker between servers. MTA-STS lets you publish that your mail servers always support TLS with valid certificates, so senders refuse to deliver over an insecure connection. Start in testing mode with TLS-RPT turned on, and switch to enforce once reports show no problems.
Frequently asked questions
Do I need to change the id when I edit the policy?
Yes. Senders cache the policy and only refetch it when the id in the TXT record changes.
Does MTA-STS affect mail I send?
No. It protects mail sent to your domain. Other domains' policies protect mail you send to them.
Related tools
- TLS-RPT CheckerValidate the SMTP TLS Reporting record that tells other mail servers where to send reports about encryption failures.
- SMTP Server TestConnect to a mail server on port 25 and check its greeting, STARTTLS support and TLS certificate, just as a sending server would.
- MX Record LookupSee which mail servers receive email for a domain, in priority order, with their IP addresses and reverse DNS.
- Email Domain Health CheckRun every email and DNS check for a domain at once and get a single report with everything that needs attention.