Check 12 of 54 · Email authentication
A policy left in testing mode, which looks present and protects nothing, or an enforced one that leaves out one of your mail servers.
Engine 1.57.0, read 25 October 2026
Can someone send email as you?
The policy file itself, fetched from mta-sts.yourdomain. Enforce passes, unless its mx: lines leave out one of your mail servers: then it fails. Testing or none warns, and so does a file that is not a valid policy (no version: STSv1 line, no mode of enforce, testing or none, or a max_age over a year).
It is common to publish MTA-STS in testing mode and forget to switch it on.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Needs the policy host to answer at scan time. We do not test your mail servers' certificates, which senders also check under enforce.
Check 12 is one of 16 in Email authentication. See it in its row on the scanner page, beside the rest of Email authentication.
The MTA-STS checker runs it on its own. It reads the policy that asks senders to deliver mail to you only over an encrypted connection, and your TLS reporting.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.