MTA-STS Checker

What the MTA-STS Checker looks at

MTA-STS has two parts: a TXT record that announces a policy, and a policy file served over HTTPS. This tool checks both, in the same way a sending server would:

1. The TXT record at _mta-sts.yourdomain. There must be exactly one record starting v=STSv1, with an id of 1 to 32 letters or digits (RFC 8461 section 3.1).
2. The policy host. mta-sts.yourdomain must resolve to a public address.
3. The policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt. It must load with HTTP 200, over a valid certificate for that host name, without redirects (section 3.3), and should be served as text/plain.
4. The policy fields: version: STSv1, mode (enforce, testing or none), one mx line per mail host, and max_age in seconds, at most 31557600 (section 3.2).
5. Your MX hosts against the policy. Each MX host must match an mx pattern. A wildcard such as *.mail.example.net matches exactly one extra label (section 4.1).
6. TLS-RPT: a TXT record at _smtp._tls.yourdomain starting v=TLSRPTv1 with a rua address (RFC 8460).

How to read the results

• Pass. That part of the setup is valid.
• Warning. It works, but protection is weaker than it could be: testing mode, a short max_age, a wrong media type, or no TLS-RPT.
• Fail. Senders will ignore your policy, or, in enforce mode, refuse to deliver to some of your MX hosts.
• Not tested. A lookup or the policy fetch timed out. We wait 5 seconds; real senders wait longer.

A working example

_mta-sts.example.com.  TXT  "v=STSv1; id=20261009T000000"
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"

Served at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: testing
mx: mx1.example.com
mx: *.mail.example.net
max_age: 1209600

Common problems and fixes

Certificate errors. The policy host needs its own valid certificate covering mta-sts.yourdomain. A certificate only for www or the bare domain isn't enough.

Redirects. Many web hosts redirect everything to www or to a page. Senders must not follow redirects, so they never see your policy. Serve the file directly.

MX host not in the policy. This usually happens after a provider change or adding a filtering service. In enforce mode, senders refuse to deliver to that host. Add the new host, publish the file, and change the id in the TXT record so senders fetch it again.

Short max_age. RFC 8461 expects a value of weeks or more, so a cached policy keeps protecting you if an attacker blocks the next fetch. Use a short value only while testing.

Changing the policy without changing the id. Senders cache the policy and only re-fetch when the id changes. Update the id every time you edit the file.

Read MTA-STS and TLS-RPT explained for the full setup.

Limitations

• We fetch the policy once, from our server, with a 5-second limit. A slow server may work for senders that wait longer.
• We compare your current MX records with the policy. We don't connect to your mail servers to test their own TLS certificates, which senders in enforce mode also check.
• MTA-STS only protects mail from senders that support it. Many large providers do; some smaller servers don't.

Related

Run the full Email Health Check to see MTA-STS alongside MX, SPF, DKIM and DMARC.