MTA-STS Policy Checker
Validate the DNS marker and HTTPS policy file that tell senders how to enforce encrypted SMTP delivery for your domain.
Workflow
Run check
Inspect a live record
Results are generated on demand so you can verify the current public configuration.
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) helps receiving domains require
encrypted SMTP delivery to known MX hosts with valid certificates.
Why check it?
The DNS marker and HTTPS policy must agree. A missing policy file, stale id, or testing mode
can leave the domain less protected than expected.
Related tool:
Check TLS-RPT reporting
so failures are visible after enforcement.
What does MTA-STS do? +
MTA-STS lets a domain publish an HTTPS policy that tells senders to require valid TLS when delivering mail to listed MX hosts.
Where is the MTA-STS policy hosted? +
The DNS marker lives at _mta-sts.example.com, while the policy file is fetched from https://mta-sts.example.com/.well-known/mta-sts.txt.
What mode should production use? +
Use testing while validating reports, then move to enforce once MX hosts and certificates are correct.