MTA-STS Checker
Check a domain's MTA-STS deployment end to end: the _mta-sts TXT record, the policy file served over HTTPS, its mode and max_age, and whether every live MX host is covered.
About MTA-STS Checker
The MTA-STS Checker performs the same discovery a sending mail server does, then tells you whether the result would actually protect your mail. It reads the _mta-sts TXT record on your domain, fetches the policy file from https://mta-sts.<domain>/.well-known/mta-sts.txt, parses the version, mode, max_age and mx patterns, and resolves your live MX records to see whether each one is covered by the policy. That last step is the one that matters most: a policy in enforce mode that omits an MX host does not weaken security, it stops mail arriving.
SMTP encryption is opportunistic by default. If STARTTLS is missing from the greeting, most senders deliver in plaintext anyway, so an attacker who strips the STARTTLS advertisement or answers on a spoofed MX gets a readable copy of your mail. RFC 8461 closes that gap by letting a domain publish a policy naming its legitimate MX hosts and requiring authenticated TLS to reach them. The failure modes are specific: testing mode reports problems but still delivers, none mode withdraws the policy, redirects on the policy URL are forbidden, and a max_age under a week narrows the cached window that resists DNS spoofing.
The policy file is requested with redirects disabled, so a redirect is reported as the RFC 8461 violation it is rather than quietly followed, and wildcard mx patterns are matched the way the specification defines them, against exactly one label. Every live MX host is then listed with a tick or a cross, so an uncovered host is impossible to miss, and each finding is graded as an error, a warning or a note. The DNS lookups and the HTTPS fetch both run server-side from our own European infrastructure, independent of your local resolver or browser.
How to use it
- 1Enter the domain that receives mail, for example example.eu, and select Check MTA-STS.
- 2Read the mode badge: enforce is the goal, testing is a warning, and no badge at all means MTA-STS is not deployed.
- 3Check the four summary fields: TXT record found, policy id, policy file served, and max_age.
- 4Compare the Policy mx patterns panel with the Live MX coverage panel and look for any host marked not covered.
- 5Work through the issues list, then increment the policy id after each policy change and re-run the check.
Common use cases
- -Confirming an MTA-STS policy is complete before you switch it from testing to enforce mode.
- -Troubleshooting mail that queues or bounces from large senders after an MX change.
- -Auditing a portfolio of domains for MTA-STS coverage alongside SPF, DKIM and DMARC.
- -Verifying the mta-sts host still serves the policy over valid HTTPS with no redirect after a web server or CDN change.
- -Planning a mail migration by checking that the new MX hosts are already covered by the published policy.
Frequently asked questions
- What does MTA-STS enforce mode do?
- In enforce mode a sending mail server must reach one of the MX hosts named in your policy over TLS, with a certificate valid for that host. If it cannot, RFC 8461 requires it to abandon the delivery attempt instead of falling back to plaintext, so the message is deferred and eventually bounced. That is genuine protection against downgrade and MX spoofing, but it also means an incomplete policy blocks legitimate mail.
- Where does the MTA-STS policy file have to be hosted?
- At https://mta-sts.<domain>/.well-known/mta-sts.txt, served over HTTPS with a certificate valid for that hostname. RFC 8461 forbids redirects, so a 301 from the bare domain or from HTTP will fail the check. The file is plain text with one key and value per line: version, mode, an mx line for each host pattern, and max_age.
- What should MTA-STS max_age be set to?
- RFC 8461 recommends at least 604800 seconds, one week, and allows up to 31557600. max_age is how long a sender caches your policy, and it is the cached copy that protects a message at the moment an attacker is tampering with your DNS answers. Short values shrink that protection, so keep max_age low only while you are testing and raise it once the policy is stable.
- Why is my MX host not covered by the MTA-STS policy?
- Because the hostname of a live MX record matches no mx pattern in the policy file. A wildcard such as *.example.eu matches exactly one label, so mx1.mail.example.eu is not covered by it. Under enforce mode senders refuse to deliver to an unlisted host, so add the missing pattern and increment the policy id so senders refresh their cached copy.