MTA-STS Look Up
Related tools
What this is
MTA-STS lets a domain require that inbound mail be delivered only over authenticated TLS to its listed MX hosts. It combines a DNS record (_mta-sts) with a policy file served at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.
How to read your result
A healthy setup shows both the DNS record and a fetchable policy file, with mode: enforce for real protection (testing only reports). Check the policy's mx: entries actually match your MX hostnames.
Common problems and how to fix them
DNS record exists but the policy file is unreachable
How it shows up: Senders cannot fetch the policy, so MTA-STS silently provides nothing; the check reports the fetch failure.
How to fix it: Serve the file at exactly https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with a valid certificate for the mta-sts subdomain. A tiny static site or a CDN worker is enough — but it must stay up.
Policy mx entries do not match the real MX records
How it shows up: In enforce mode, legitimate mail from strict senders starts getting refused after an MX change.
How to fix it: Update the policy file whenever MX records change (and bump the id= in the DNS record so caches refresh). Automate this pairing if MX changes are at all frequent.
Stuck in testing mode forever
How it shows up: TLSRPT reports arrive but downgrade attacks would still succeed — testing mode never blocks anything.
How to fix it: After a clean period in testing (watch your TLSRPT reports), switch mode: to enforce and bump the id=.
Related reading
- MTA-STS: Forcing Encrypted SMTP, and How to Check It Is Actually OnMTA-STS turns opportunistic SMTP encryption into an enforced policy. Here is how the DNS record and policy file work, and how to verify both are live.
- Email Health Check: One Lookup for MX, SPF, DMARC, and TLSRun one domain lookup to see whether your MX, SPF, DMARC, MTA-STS, and TLS-RPT records are configured correctly and where your email is exposed.
Frequently asked questions
- What is an MTA-STS record?
- MTA-STS (Mail Transfer Agent Strict Transport Security) is a TXT record published at _mta-sts.yourdomain that announces your domain uses an MTA-STS policy. It carries a version and a policy ID, while the actual policy rules are served separately over HTTPS at mta-sts.yourdomain/.well-known/mta-sts.txt.
- How do I use this tool?
- Enter a domain and the tool queries the _mta-sts TXT record for that domain server-side, then displays whether a record exists and its parsed fields. It checks DNS only, so you can confirm the record is published and read its version and id values.
- Why does MTA-STS matter?
- MTA-STS lets sending mail servers require TLS-encrypted, authenticated connections when delivering to your domain, blocking downgrade and man-in-the-middle attacks that plain SMTP is vulnerable to. Without it, an attacker on the network path could strip encryption and intercept inbound email.
- How do I read the result?
- A valid record looks like "v=STSv1; id=20240101000000", where v is the version and id is a unique string you change whenever you update your policy. If no record is found, MTA-STS is not active for the domain and you should publish the TXT record plus the HTTPS policy file.
- Does a published record mean MTA-STS is fully working?
- No, this tool confirms only the DNS side; a complete setup also requires the policy file at mta-sts.yourdomain/.well-known/mta-sts.txt to be reachable over valid HTTPS with matching MX hosts. The DNS record can exist while the policy file is missing or broken, so verify both.