Does the MTA-STS checker change my DNS?

No. It performs live DNS, HTTPS, and SMTP checks and reports what is currently published.

What does the MTA-STS DNS record do?

The _mta-sts TXT record tells senders that the domain has an MTA-STS policy. It must start with v=STSv1 and include an id value that changes whenever the policy changes.

Where is the MTA-STS policy file hosted?

The policy file is fetched from https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Senders use it to learn the policy mode, max age, and allowed MX host patterns.

Why do MX records need to match the policy file?

In enforce mode, senders that support MTA-STS should only deliver to MX hosts that match the policy. If live MX records are missing from the policy, delivery can be deferred or fail.

Why does STARTTLS support matter?

MTA-STS is designed to protect SMTP delivery with TLS. If an MX server does not advertise STARTTLS or cannot upgrade cleanly, senders may not be able to deliver securely.

MTA-STS checker

Check your domain's MTA-STS DNS record, policy file, MX records, and SMTP TLS support.

Check your MTA-STS setup

MTA-STS scan

Run a live MTA-STS check to verify your DNS record, HTTPS policy file, MX coverage, and SMTP TLS support. For managed hosting, use Suped's hosted MTA-STS to publish the policy file without maintaining web hosting. For broader authentication checks, use the domain health checker.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

One MTA-STS checker, endless uses

Use the MTA-STS checker to audit a new domain, confirm a hosted policy rollout, troubleshoot TLS delivery errors, or review client mail security before enforcement. It checks the DNS TXT record, downloads the policy file, compares policy MX hosts against live MX records, and tests whether MX servers can upgrade to encrypted SMTP connections.

Record found

Single record

Record valid

MTA-STS DNS checks

Confirm the _mta-sts TXT record exists, is unique, and has valid v and id tags.

DMARCvalid

SPFvalid

DKIMfound

Policy file validation

Fetch the HTTPS policy file and validate version, mode, max age, and MX entries.

TLS encryption used

TLS 1.3