MTA-STS checker
Check MTA-STS policy and TLS-RPT — enforces encrypted email transport.
How this tool works
The MTA-STS checker verifies if a domain has MTA-STS (Mail Transfer Agent Strict Transport Security) configured. MTA-STS enforces TLS encryption during email transport and protects against downgrade attacks. Checked are the DNS record (_mta-sts), the policy file and the TLS-RPT record for reporting.
Typical use cases
- Validate MTA-STS setup after configuration
- Check if policy file is correctly reachable under .well-known
- Validate TLS-RPT configuration
- Email security audit for enterprise domains
Frequently asked questions
What is MTA-STS?
MTA-STS (RFC 8461) allows domains to declare that incoming emails must only be accepted over TLS-encrypted connections. Prevents STARTTLS stripping by man-in-the-middle.
Which components does MTA-STS need?
1. DNS TXT record at _mta-sts.domain.invalid (v=STSv1; id=...). 2. Policy file at https://mta-sts.domain.invalid/.well-known/mta-sts.txt. 3. Optional: TLS-RPT DNS record at _smtp._tls.
What does mode: enforce mean?
enforce = emails are rejected if TLS connection is not possible. testing = emails are delivered but failures reported (via TLS-RPT). none = disabled.
What is TLS-RPT?
TLS Reporting (RFC 8460) — sending servers send reports about failed TLS connections to the address specified in DNS. Helps detect problems early.
Do you need MTA-STS if you already have DANE?
DANE and MTA-STS complement each other. DANE relies on DNSSEC (not universally available), MTA-STS on HTTPS. Both together provide best coverage.
How often should the policy ID be changed?
Whenever the policy file changes. The ID in the DNS record signals sending servers to reload the policy. Recommendation: timestamp as ID.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.