MTA-STS Checker
Check Mail Transfer Agent Strict Transport Security records
Try examples:
Ready to Check MTA-STS Records
Enter a domain name above to check its MTA-STS DNS records and policy configuration.
This page provides original, human-reviewed information about MTA-STS policy lookups, explaining the well-known policy file, enforce versus testing modes, and how MTA-STS enforces TLS for inbound SMTP.
MTA-STS (Mail Transfer Agent Strict Transport Security) is an email security standard that enables mail service providers to declare their ability to receive TLS-secured connections and to specify whether sending SMTP servers should refuse to deliver to MX hosts that do not offer TLS with a trusted server certificate.
Key Components:
- DNS TXT Record:Published at _mta-sts.domain.com to advertise MTA-STS support
- Policy File:Hosted at https://mta-sts.domain.com/.well-known/mta-sts.txt
- Mode:Can be "enforce", "testing", or "none"
- Max Age:How long the policy should be cached
How MTA-STS Works:
- Sending mail server checks for _mta-sts.domain.com TXT record
- If found, fetches the policy file from https://mta-sts.domain.com/.well-known/mta-sts.txt
- Validates that the receiving MX servers support TLS and have valid certificates
- Enforces the policy based on the specified mode
Step 1: Create DNS TXT Record
The "id" should be updated whenever you change your policy file.
Step 2: Create Policy File
Host a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt
Step 3: Configure HTTPS
Ensure mta-sts.example.com has a valid TLS certificate and serves the policy file over HTTPS.
Policy File Not Accessible
The policy file at https://mta-sts.domain.com/.well-known/mta-sts.txt is not reachable.
Solution: Ensure HTTPS is properly configured and the file exists.
Certificate Mismatch
MX servers don't have valid TLS certificates matching their hostnames.
Solution: Ensure all MX hosts have proper TLS certificates.
Policy ID Mismatch
The policy ID in DNS doesn't match recent policy changes.
Solution: Update the DNS TXT record ID when modifying the policy.
Mode Configuration
Choosing the right mode for your deployment stage.
Solution: Use "testing" for monitoring, "enforce" for active protection.
How long does MTA-STS policy caching last?
The max_age value in your policy file determines how long sending servers cache your policy.Common values are 86400 (1 day) to 604800 (1 week).
What's the difference between "enforce" and "testing" modes?
"Testing" mode allows monitoring of policy violations without blocking email delivery."Enforce" mode actively rejects emails that don't comply with the policy.
Do I need MTA-STS if I have DANE?
MTA-STS and DANE serve similar purposes but work differently. MTA-STS is easier to implementand doesn't require DNSSEC, making it more widely adopted.
How do I monitor MTA-STS compliance?
Implement TLS-RPT (TLS Reporting) alongside MTA-STS to receive reports about TLS connectionfailures and policy violations.
Can I use wildcards in MX hostnames?
Yes, you can use wildcards like "*.mail.example.com" in your MTA-STS policy to matchmultiple MX servers with a single entry.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.