MTA-STS checker

Validate your MTA-STS record and policy file, check MX coverage and look for a TLS-RPT record.

Example setup

TXT at _mta-sts.example.com:

v=STSv1; id=20261021T000000

File at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: testing
mx: mx1.example.com
mx: *.mail.example.net
max_age: 604800

TXT at _smtp._tls.example.com:

v=TLSRPTv1; rua=mailto:tls-reports@example.com

The policy file must be served with a valid certificate for mta-sts.yourdomain, without redirects. Every MX host must match an mx: line (wildcards cover one label).

Get alerted when it changes

Free daily monitoring re-checks SPF, DKIM, DMARC, MX, BIMI and MTA-STS and emails you when something changes or fails.

Set up free monitoring

Frequently asked questions

What is MTA-STS?

MTA-STS (RFC 8461) lets a domain tell sending servers that its MX hosts support TLS with valid certificates, so mail is not delivered over an unencrypted or intercepted connection.

What do I need to publish?

A TXT record at _mta-sts.yourdomain (v=STSv1; id=…), and a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt listing version, mode, mx and max_age. Change id whenever the policy changes.

Should I start in testing mode?

Yes. Use mode: testing with a TLS-RPT record (_smtp._tls TXT v=TLSRPTv1; rua=mailto:…) so you receive failure reports, then switch to enforce.