MTA-STS checker

Bookmark

Use this free MTA-STS checker tool to inspect DNS, HTTPS policy, MX coverage, SMTP STARTTLS support and the TLS-RPT record.

Check your MTA-STS setup

MTA-STS scan

Use this MTA-STS checker tool to inspect your DNS record, HTTPS policy, MX coverage, SMTP STARTTLS support and TLS-RPT record. For managed hosting, use Suped's hosted MTA-STS to publish the policy file without maintaining web hosting. For broader authentication checks, use the domain health checker.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

MTA-STS record example and HTTPS policy validation

MTA-STS pairs a TXT record at _mta-sts with a policy at https://mta-sts.example.com/.well-known/mta-sts.txt. The policy sets MX hosts, mode and cache lifetime; change the TXT id whenever you update it.

DNS TXT at _mta-sts.example.com: v=STSv1; id=20261008 HTTPS policy: version: STSv1 mode: testing mx: mail.example.com max_age: 86400

Replace the MX hostname and verify your mail hosts before choosing enforce mode.

Learn about hosted MTA-STS policies

Interpret an MX mismatch or SMTP TLS failure

An MX mismatch means the policy excludes a published mail host. A failed STARTTLS test may indicate unsupported TLS or a network or test-service problem, so recheck before changing configuration.

TLS-RPT checks after MTA-STS setup

TLS-RPT reports delivery problems to destinations in _smtp._tls; this tool checks the record, not the reports. MTA-STS protects incoming SMTP transport, while SPF, DKIM and DMARC authenticate senders.

Check your domain's email authentication too

Check the DNS, policy, and TLS parts of MTA-STS

Audit a new domain or review a policy before enforcement. The checker looks up MTA-STS and TLS-RPT records, downloads the HTTPS policy, compares its allowed hosts with live MX records, and tests SMTP STARTTLS support.

Record found

Single record

Record valid

MTA-STS DNS checks

Confirm the _mta-sts TXT record exists, is unique, and has valid v and id tags.

DMARCvalid

SPFvalid

DKIMfound

Policy file validation

Fetch the HTTPS policy file and validate version, mode, max age, and MX entries.

TLS encryption used

TLS 1.3

MX STARTTLS testing

Connect to live MX servers and check whether SMTP can upgrade to encrypted delivery.

Health report

Copy link

Shareable audit

Send the same MTA-STS report to a client, vendor, or teammate without screenshots.

DNS provider

Managed in Vercel

TLS-RPT record checks

Check whether a single valid TLS reporting record is published at _smtp._tls for delivery-failure reports.

p=nonequarantinereject

Policy mode review

Check whether the policy is still testing or ready for enforce mode after MX validation passes.

MTA-STS checker FAQs

Answers to common questions about checking MTA-STS records, policy files, MX coverage, and mail server TLS support.

No. It performs live DNS, HTTPS, and SMTP checks and reports what is currently published.

The _mta-sts TXT record tells senders that the domain has an MTA-STS policy. It must start with v=STSv1 and include an id value that changes whenever the policy changes.

The policy file is fetched from https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Senders use it to learn the policy mode, max age, and allowed MX host patterns.

In enforce mode, senders that support MTA-STS should only deliver to MX hosts that match the policy. If live MX records are missing from the policy, delivery can be deferred or fail.

MTA-STS is designed to protect SMTP delivery with TLS. If an MX server does not advertise STARTTLS or cannot upgrade cleanly, senders may not be able to deliver securely.

No. It checks the TLS-RPT DNS record at _smtp._tls, including whether it is present, unique, and valid. It does not receive or analyze TLS delivery reports.