Free tool · MTA-STS checker
Does mail sent to youhave to arrive encrypted?
Check a domain's MTA-STS record and policy file: that it loads over HTTPS, which mode it is in, and that it covers every mail server. Free, no sign-up.
We log the domain you check to keep this tool working and see which tools are worth building. See our Privacy Policy.
What we check for MTA-STS
The record
A TXT record at _mta-sts.yourdomain with v=STSv1 and an id= that you change whenever the policy changes.
The policy file
A small text file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, served over valid HTTPS with no redirects.
The match
Every mail server in your MX records has to be listed in the policy. In enforce mode, senders refuse to deliver to one that is not.
Frequently asked questions
What does MTA-STS protect against?
Email between servers is usually encrypted, but an attacker on the network can strip that and read or change the message. MTA-STS tells sending servers that your domain always accepts encrypted, verified connections, so they refuse to send any other way.
Should I use testing or enforce mode?
Start with mode: testing and add TLS reporting, so you get reports of any failures without losing mail. After a couple of weeks with no failures, switch to mode: enforce and change the id= in your _mta-sts record.
Why does the policy file fail to load?
Usually because the mta-sts subdomain has no website behind it, its certificate does not cover that name, or the file redirects somewhere else. All three stop senders from using the policy.
I changed mail providers. What do I update?
Add the new mail servers as mx: lines in the policy file, then change the id= in the _mta-sts TXT record so senders fetch the new version. If you skip this in enforce mode, mail to the new servers can bounce.
More free email tools
Email security check
SPF, DKIM, DMARC, MTA-STS, TLS reporting, BIMI and DNSSEC in one check, with a grade.
SPF checker
See who may send as your domain and how many of the 10 DNS lookups you use.
DMARC checker
See whether spoofed mail is blocked, and where your reports go.
DMARC record generator
Build a DMARC record step by step, starting safely in monitoring mode.
Hear about it the day your email setup changes
Domain Lab checks SPF, DKIM, DMARC, MTA-STS, TLS reporting, BIMI and DNSSEC every day, alongside registration, DNS and SSL, and tells you what changed and how to fix it. Free for your first domain.
Start monitoring free