MTA-STS checker
Check your domain's MTA-STS DNS record, policy file, MX records, and SMTP TLS support.
Check your MTA-STS setup
MTA-STS scan
Run a live MTA-STS check to verify your DNS record, HTTPS policy file, MX coverage, and SMTP TLS support. For managed hosting, use Suped's hosted MTA-STS to publish the policy file without maintaining web hosting. For broader authentication checks, use the domain health checker.
Get started
One MTA-STS checker, endless uses
Use the MTA-STS checker to audit a new domain, confirm a hosted policy rollout, troubleshoot TLS delivery errors, or review client mail security before enforcement. It checks the DNS TXT record, downloads the policy file, compares policy MX hosts against live MX records, and tests whether MX servers can upgrade to encrypted SMTP connections.
Record found
Single record
Record valid
MTA-STS DNS checks
Confirm the _mta-sts TXT record exists, is unique, and has valid v and id tags.
DMARCvalid
SPFvalid
DKIMfound
Policy file validation
Fetch the HTTPS policy file and validate version, mode, max age, and MX entries.
TLS encryption used
TLS 1.3
MX STARTTLS testing
Connect to live MX servers and check whether SMTP can upgrade to encrypted delivery.
Health report
Copy link
Shareable audit
Send the same MTA-STS report to a client, vendor, or teammate without screenshots.
DNS provider
Managed in Vercel
DNS provider context
Identify where the _mta-sts record is managed so policy updates happen in the right account.
p=nonequarantinereject
Policy mode review
Check whether the policy is still testing or ready for enforce mode after MX validation passes.
MTA-STS checker FAQs
Answers to common questions about checking MTA-STS records, policy files, MX coverage, and mail server TLS support.
No. It performs live DNS, HTTPS, and SMTP checks and reports what is currently published.
The _mta-sts TXT record tells senders that the domain has an MTA-STS policy. It must start with v=STSv1 and include an id value that changes whenever the policy changes.
The policy file is fetched from https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Senders use it to learn the policy mode, max age, and allowed MX host patterns.
In enforce mode, senders that support MTA-STS should only deliver to MX hosts that match the policy. If live MX records are missing from the policy, delivery can be deferred or fail.
MTA-STS is designed to protect SMTP delivery with TLS. If an MX server does not advertise STARTTLS or cannot upgrade cleanly, senders may not be able to deliver securely.
How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped
See how MONEYME uses Suped
How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped
See how Jam Cyber uses Suped
How Vision Australia maintains full DMARC enforcement across a large domain portfolio with Suped
See how Vision Australia uses Suped
How The POP Team turns domain checks and DMARC visibility into client ready delivery work
See how The POP Team uses Suped
How DigiBean simplified DMARC monitoring and improved email security for their MSP clients
See how DigiBean uses Suped
How Alliance Group moved from reactive guesswork to proactive email management with Suped
See how Alliance Group uses Suped
Start monitoring your DMARC reports today
What you'll get with Suped
Real-time DMARC report monitoring and analysis
Automated alerts for authentication failures
Clear recommendations to improve email deliverability
Protection against phishing and domain spoofing