One record, one valid file
One TXT record at _mta-sts, starting v=STSv1, and a policy file senders can read. Two records, or a file that is not valid, and senders apply no policy.
MTA-STS checker
Check your MTA-STS record. Free, with no account.
Type in a domain. We read its MTA-STS record, fetch the policy file it points to as a sending server would, read its TLS reporting record, and grade all three as the Full Report does.
- Reads only what is already public
- No account, nothing to install
- Checks TLS reporting as well
What the MTA-STS checker looks at
Enforce, not testing
In testing mode a policy only reports problems. In enforce mode senders refuse a connection that fails it, which is what protects your mail.
Every mail server named
The policy's mx lines must match each of your MX hosts. In enforce mode, a host left out is a host senders refuse to deliver to.
TLS reporting
A TLS-RPT record at _smtp._tls asks senders to tell you when secure delivery to you fails, so a broken policy does not go unseen.
These are checks 5, 12 and 6 on the scanner page, graded by the same rules as the free check and the Full Report.
Reading MTA-STS
DNS · TXT · _mta-sts.yourcompany.co.ukExample
v=STSv1; id=20261009T000000
HTTPS · text file · mta-sts.yourcompany.co.uk/.well-known/mta-sts.txtExample
version: STSv1 mode: enforce mx: yourcompany-co-uk.mail.protection.outlook.com max_age: 604800
DNS · TXT · _smtp._tls.yourcompany.co.ukExample
v=TLSRPTv1; rua=mailto:tls-reports@yourcompany.co.uk
The record says a policy exists. Change its id whenever the policy file changes, so senders fetch it again.
The policy file names a mode, every mail server mail may be delivered to as an mx line, and how many seconds senders may keep it as max_age.
The TLS reporting record says where senders send their daily reports of deliveries that failed.
How MTA-STS works, and how to move from testing to enforce safely: MTA-STS and TLS reporting explained.
Questions
What is MTA-STS?
A way to tell other mail servers that mail to your domain must arrive over an encrypted connection to a server you named. It is a DNS record and a small policy file at an https address.
How do I check my MTA-STS record?
Type your domain into the checker at the top of this page. We read the record, fetch the policy file as a sending server would and read your TLS reporting record. You need no account.
What is the difference between testing and enforce?
In testing, senders deliver as normal and report what failed. In enforce, they refuse to deliver over a connection that fails the policy. Start in testing, read the reports, then enforce.
What is TLS-RPT?
A DNS record at _smtp._tls that asks senders to email you a daily report of secure deliveries that failed. It is how you find out a policy or a certificate is wrong.
Why does the policy have to name my mail servers?
Senders deliver only to servers the policy names. Leave one out in enforce mode and mail to it is refused.
Do I need a website for MTA-STS?
You need the policy file served over https at mta-sts on your domain, with a valid certificate. It can be the only thing at that address.
More free checkers
TXT · your domain
SPF checker
Reads the record that lists the servers allowed to send email as you, and counts the DNS lookups it costs.
Check SPFTXT · _dmarc
DMARC checker
Reads your instruction to inboxes about mail that fails, and whether its reports reach anyone.
Check DMARCTXT · selector._domainkey
DKIM checker
Reads the public keys that prove your email was signed by you, on the common selectors or your own.
Check DKIM
Start with the free check.
It reads your SPF, DKIM and DMARC records in about 30 seconds, and tells you where you stand today.