What it reads
The TXT record at _mta-sts.yourdomain.
Check 5 of 54 · Email authentication
MTA-STS record, explained.
Whether you have told other mail servers to encrypt mail they deliver to you.
Engine 1.57.0, read 25 October 2026
Free checkScoredReliability: Definitive
Can someone send email as you?
What the check does, and where it stops.
Why it matters
Without MTA-STS, someone on the path can strip the encryption from mail on its way to you, and neither side is told.
What a failure looks like
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Where its limits are
Presence only, and more than one record counts as none. Whether the policy is switched on is check 12.
ReliabilityDefinitive: reads a published value
Check 5 is one of 16 in Email authentication. See it in its row on the scanner page, beside the rest of Email authentication.
Run this check on any domain. Free, with no account.
The MTA-STS checker runs it on its own. It reads the policy that asks senders to deliver mail to you only over an encrypted connection, and your TLS reporting.
See how your domain does.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.