Free · live registry data · no login

MTA-STS & TLS-RPT Checker

Confirm transport security policies for inbound mail.

How it works

MTA-STS and TLS-RPT checker: confirm inbound mail is forced over TLS

MTA-STS tells sending servers that your mail servers support TLS and must not be downgraded to plaintext; TLS-RPT tells them where to report failures. We fetch the _mta-sts TXT record, download the policy file from https://mta-sts.yourdomain/.well-known/mta-sts.txt with a real server-side request, parse version, mode, max_age and mx patterns, and cross-check every pattern against your live MX records. Then we read _smtp._tls for TLS-RPT so you know whether anyone would tell you if encryption failed.

Results appear here after you click Check MTA-STS.

How this works

1
Read the DNS records
_mta-sts and _smtp._tls TXT records are fetched live along with your MX records.
2
Download the policy
A server-side HTTPS request retrieves mta-sts.txt exactly as a sending server would.
3
Cross-check MX hosts
Each MX hostname is matched against the policy's mx patterns to catch hosts that would be refused.

Frequently asked questions

What is MTA-STS?: SMTP MTA Strict Transport Security (RFC 8461) lets a domain declare that its mail servers support TLS with valid certificates. Senders that honour it refuse to deliver over plaintext, defeating downgrade attacks.
Why do I need both a DNS record and a policy file?: The DNS TXT record signals that a policy exists and carries an id that changes when the policy updates. The policy itself lives over HTTPS so it cannot be tampered with by someone who can spoof DNS.
What is TLS-RPT?: SMTP TLS Reporting (RFC 8460) is a TXT record at _smtp._tls that tells senders where to email daily JSON reports about TLS negotiation failures to your domain. It is how you find out MTA-STS is breaking something.
Should I start with mode testing or enforce?: Start with testing plus TLS-RPT. Senders report problems but still deliver. After a couple of weeks without failures, switch to enforce and raise max_age.
Do Google Workspace or Microsoft 365 support MTA-STS?: Both support receiving mail under MTA-STS and Gmail enforces policies when sending. You still need to publish the DNS record and host the policy file yourself; the providers do not do it for your domain.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.