MTA-STS Checker
Check whether a domain enforces TLS on inbound mail.
SMTP negotiates encryption opportunistically: a sending server asks whether TLS is available and, if the answer is no or the handshake fails, it delivers the message in plain text anyway. An attacker who can interfere with the connection simply strips the offer, and the mail arrives unencrypted with nobody notified. MTA-STS is the fix — it lets a domain publish, over HTTPS with a certificate, that senders must use TLS and must verify the certificate.
The mechanism has two halves and both must work. A TXT record at _mta-sts.yourdomain advertises a policy and carries an id that changes when the policy does. The policy itself is a text file served at https://mta-sts.yourdomain/.well-known/mta-sts.txt, listing the MX hosts it covers, a mode, and how long to cache it. Publishing the record without a reachable policy is the common failure, and it is worse than publishing nothing.
The mistake that causes outages is an incomplete mx list. In enforce mode a sender refuses to deliver to any MX host that does not match a line in the policy — so adding a mail host without updating the policy silently rejects mail to it. This is exactly why TLS-RPT exists, and why you should run in testing mode with reporting until the reports come back clean.
What this tool does
Record and policy
Reads the TXT record, then fetches the policy file it advertises. A record without a reachable policy is worse than no record at all.
MX coverage
Every host in your MX records is matched against the policy’s mx lines, including single-label wildcards. An uncovered host means rejected mail in enforce mode.
Mode that matters
Only enforce actually protects anything. Testing reports failures while still delivering in the clear.
Cache lifetime
A short max_age shortens the window an attacker has to outlast by blocking policy fetches.
Frequently asked questions
What problem does MTA-STS solve?
SMTP encryption is opportunistic: if TLS is unavailable, mail is delivered in plain text rather than being refused. An attacker in the network path can strip the STARTTLS offer and read everything. MTA-STS lets a domain state that senders must use verified TLS, so a stripped connection results in a refused delivery instead of an exposed message.
What is the difference between testing and enforce mode?
In testing, a sender that cannot establish verified TLS delivers anyway and sends you a report. In enforce, it refuses to deliver. Testing gives you visibility with no protection; enforce gives protection with the risk that a misconfigured policy blocks real mail. Start in testing, watch the TLS-RPT reports, then switch.
Why does MTA-STS need a web server?
Because DNS alone is not authenticated unless you run DNSSEC. Serving the policy over HTTPS at mta-sts.yourdomain means the sender validates a certificate for that hostname, which is what makes the policy trustworthy. It is also why the policy host needs a valid certificate of its own.
How is this different from DANE?
Both force authenticated TLS. DANE publishes certificate constraints in DNSSEC-signed DNS records; MTA-STS uses HTTPS and the public certificate authorities instead. DANE is stronger but requires DNSSEC end to end. They coexist, and large providers commonly publish both.
What happens if my policy file goes offline?
Senders that already cached it keep enforcing until max_age expires. Senders that have not fetched it fall back to ordinary opportunistic TLS. So an outage degrades rather than breaks delivery — but it removes your protection, which is why max_age is worth setting generously once you are confident.
Do I need MTA-STS if I already have DMARC?
Yes, they address different threats. DMARC stops other people sending mail that claims to be from you. MTA-STS stops mail sent to you from being read in transit. A domain can have perfect DMARC and still have every inbound message delivered in plain text.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.