Free MTA-STS Policy Checker & Validator
MTA-STS (Mail Transfer Agent Strict Transport Security) is an email security standard (RFC 8461) that enables mail servers to declare their ability to receive TLS-secured SMTP connections. It helps prevent man-in-the-middle attacks and downgrade attacks on email delivery. Our free MTA-STS checker verifies both the DNS TXT record at _mta-sts and the policy file at .well-known/mta-sts.txt, ensuring your email transport security is properly configured.
What This Tool Checks
Comprehensive analysis powered by Vysiro's scanning engines
_mta-sts TXT record existence verification
Policy file (.well-known/mta-sts.txt) retrieval and parsing
Policy mode validation (enforce, testing, none)
MX host matching against policy
Max age (max_age) configuration check
HTTPS delivery validation for policy file
TLS-RPT (RFC 8460) reporting record check
Clear MTA-STS deployment recommendations
How It Works
Get results in seconds with our automated scanning process
Enter your domain name in the scanner above
We query DNS for the _mta-sts TXT record
We fetch the policy file from https://mta-sts.{domain}/.well-known/mta-sts.txt
Our engine validates the policy mode, MX entries, and max_age
We check for TLS-RPT reporting configuration
You receive a complete MTA-STS compliance report with fixes
Frequently Asked Questions
Everything you need to know about mta-sts policy checker
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) is an email security protocol that allows domain owners to declare that their mail servers support TLS encryption and that sending servers should refuse to deliver mail over unencrypted connections. It prevents SMTP downgrade attacks and man-in-the-middle interception of email.
How does MTA-STS work?
MTA-STS works in two parts: a DNS TXT record at _mta-sts.yourdomain.com that signals MTA-STS support and contains a version ID, and a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt that specifies the policy mode (enforce/testing/none), authorized MX hosts, and cache duration.
What MTA-STS policy mode should I use?
Start with mode: testing to receive TLS-RPT failure reports without affecting delivery. Once you confirm all sending servers can connect via TLS successfully, switch to mode: enforce to require TLS for all inbound mail. The testing mode lets you identify issues before enforcement.
What is TLS-RPT and do I need it?
TLS-RPT (TLS Reporting, RFC 8460) is a companion standard to MTA-STS that enables sending mail servers to report TLS connection failures. You should publish a _smtp._tls TXT record with a reporting address so you receive reports about delivery issues. It is strongly recommended alongside MTA-STS.
Does MTA-STS replace STARTTLS?
No, MTA-STS works alongside STARTTLS. While STARTTLS upgrades SMTP connections to use TLS, it is opportunistic and vulnerable to downgrade attacks. MTA-STS tells sending servers that TLS is required, preventing attackers from stripping the STARTTLS offer. Both are needed for robust email transport security.
How do I set up MTA-STS?
Create a DNS TXT record at _mta-sts.yourdomain.com with content like 'v=STSv1; id=20240101T000000'. Then serve a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing your MX servers and policy mode. The policy file must be served over valid HTTPS.
Related Free Tools
Continue your domain security analysis
DMARC Checker
Analyze DMARC records and email authentication policies instantly.
Use toolMX Lookup
Look up and analyze mail exchange records and mail routing.
Use toolSSL Inspector
Analyze SSL/TLS certificates, expiration, and security configuration.
Use toolDANE Checker
Verify DANE TLSA records for certificate-based authentication.
Use toolGo Beyond Free Checks
Get continuous monitoring, automated fixes, proof packs, and API access. Protect your domains with Vysiro's agentless attack-surface monitor.