About this tool. MTA-STS tells sending servers they must use verified TLS when delivering to you, blocking downgrade and man-in-the-middle attacks. It needs both a DNS record and a policy file — this check validates the pair together.
Ten signals decide whether your mail arrives. You just checked one.
MTA-STS protects the mail arriving at you. It says nothing about whether the mail leaving you is trusted, which is decided by SPF, DKIM and DMARC.
- SPF, DKIM, DMARC, MX and blocklist status, graded A to F in one pass
- Every problem written out in plain English, with the record to publish
- Saved under Reports, so you can re-run it and see what changed
- One domain watched against the blocklists daily
Run the full checkup free
No card, and nothing to cancel.
How to read your MTA-STS setup
- MTA-STS tells other servers to require TLS encryption when delivering mail to you, and not to fall back to plaintext.
- It needs a TXT record at _mta-sts.yourdomain and a policy file served over HTTPS at mta-sts.yourdomain.
Common problems and how to fix them
MTA-STS record present but not enforced
Confirm the HTTPS policy file exists at the mta-sts subdomain and lists the correct MX hosts, with mode set to enforce.
Common questions.What is MTA-STS?
A standard that lets a domain require encrypted (TLS) delivery of inbound mail, closing a gap where attackers could force plaintext.
Is MTA-STS required?
No, but it hardens inbound mail against downgrade attacks. Pair it with TLS-RPT to get reports when encryption fails.