MTA-STS Record Checker
Check any domain's MTA-STS policy and TLS-RPT record: see the enforcement mode, allowed mail servers, and whether inbound email is protected from downgrade attacks. Free, no signup.
What is an MTA-STS record?
MTA-STS is the standard that upgrades email-in-transit encryption from “use TLS if you can” to “use TLS or don't deliver.” It combines a DNS TXT record at _mta-sts.yourdomain.com with a policy file hosted over HTTPS that names your mail servers and an enforcement mode. Sending servers that support MTA-STS: including Gmail and Microsoft 365: fetch that policy and refuse to hand your mail to an impostor server or over a stripped connection. Pair it with DMARC and a BIMI record for a complete inbound-and-outbound email security posture, and read the full guide to MTA-STS.
Email authentication knowledge base
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) lets a domain tell other mail servers that they must use encrypted, authenticated TLS to deliver email to it. Without it, SMTP encryption is opportunistic: an attacker who can intercept the connection can strip TLS and read or alter messages (a downgrade attack). MTA-STS closes that gap by publishing a policy sending servers are required to honour.
What does an MTA-STS deployment consist of?
Two parts that must both be present. First, a DNS TXT record at _mta-sts.yourdomain.com containing v=STSv1 and an id. Second, a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt that lists the mode (testing or enforce), the allowed mail servers (mx), and a max_age. The DNS record tells senders a policy exists and when it last changed; the HTTPS file is the policy itself. If either is missing or the certificate on the mta-sts host is invalid, MTA-STS does not take effect.
How does this MTA-STS checker work?
Enter a domain and the tool looks up the _mta-sts TXT record, fetches the policy file from the mta-sts host over HTTPS, and reads your _smtp._tls TXT record for TLS-RPT. It then shows the enforcement mode, the mail servers your policy allows, the max_age, and whether reporting is configured, so you can confirm the whole setup resolves the way a sending server would see it.
What is the difference between testing and enforce mode?
In testing mode, a sending server that can't establish valid TLS still delivers the message, but (if TLS-RPT is set up) reports the failure to you. In enforce mode, that same server refuses to deliver until it can make an authenticated TLS connection to a listed MX. Always start in testing, watch your TLS-RPT reports until failures are explained, then switch to enforce. Going straight to enforce with a misconfigured MX list can bounce legitimate mail.
What is TLS-RPT and do I need it?
TLS-RPT (RFC 8460) is a companion TXT record at _smtp._tls.yourdomain.com that asks receivers to send you daily reports about TLS connection results, successes and failures. It's strongly recommended: those reports are how you find out whether your MTA-STS policy is causing problems before you move to enforce, and how you spot ongoing delivery issues afterward.
How is MTA-STS different from DANE?
Both force TLS for inbound mail, but they anchor trust differently. DANE publishes certificate fingerprints in DNS and depends on DNSSEC being deployed on your domain. MTA-STS relies on the web PKI (a valid certificate on the mta-sts host) and does not require DNSSEC, which makes it much easier to adopt: that's why Google, Microsoft, and Yahoo support MTA-STS. Domains that already run DNSSEC often publish both.
Why does the policy file have to be on a subdomain called mta-sts?
The standard fixes the location: senders fetch https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. The mta-sts subdomain needs its own A/AAAA (or CNAME) record and a valid TLS certificate covering that hostname. A common failure is publishing the DNS TXT record but never standing up the mta-sts host, or letting its certificate expire, the checker above flags that case.
Does Palisade set up MTA-STS for me?
Yes. Palisade publishes the _mta-sts DNS record, hosts the policy file for you on redundant infrastructure, keeps the id in sync when the policy changes, and helps you move from testing to enforce once your TLS-RPT reports are clean: across every domain you manage, alongside SPF, DKIM, DMARC, and BIMI.
Every tag in an MTA-STS deployment and its TLS-RPT companion, explained.
- vVersion (DNS record)
- The version tag in the _mta-sts TXT record. It must be set to ‘STSv1’. If it is missing or wrong, receivers ignore the record and never fetch your policy file.
- idPolicy identifier
- A unique string in the _mta-sts TXT record (commonly a timestamp like 20240419T120000). Whenever you change the hosted policy file, you must also change the id so senders know to re-fetch it. Reusing an old id means caches keep serving your previous policy.
- modeEnforcement mode
- Set in the policy file. ‘testing’ reports TLS problems but still delivers mail if TLS fails or the certificate is invalid, the safe first step. ‘enforce’ tells sending servers to refuse delivery unless they can make a valid, authenticated TLS connection to a listed MX. ‘none’ withdraws the policy.
- mxAllowed mail servers
- One or more mx lines in the policy file listing the mail-server hostnames allowed to receive your mail, e.g. mail.example.com or a wildcard like *.example.net. They should match your published MX records. A sending server only enforces TLS against hosts on this list.
- max_agePolicy lifetime
- How long (in seconds) senders may cache your policy, in the policy file. A common value is 604800 (one week). Longer caching is more resistant to downgrade attacks but makes changes propagate slowly; start lower while testing, then raise it once the policy is stable.
- ruaTLS-RPT report address
- In the companion _smtp._tls TXT record (v=TLSRPTv1), rua is where receivers send daily TLS reporting, a mailto, or https: destination. These reports reveal how often mail to your domain fails TLS, which is how you gain the confidence to move MTA-STS from testing to enforce.