Email

MTA-STS & TLS-RPT Checker

MTA-STS & TLS-RPT

Check MTA-STS policy

Enter a domain name to validate its MTA-STS policy, DNS records, and TLS reporting configuration.

DNS Resolver

Most domains return the same records on every resolver — the choice matters during DNS propagation, or when a filtering resolver blocks a domain.

No domain checked yet

Enter a domain above and click Check MTA-STS & TLS-RPT to validate its configuration.

Tool features

A complete MTA-STS and TLS-RPT validation
4 checks

DNS Records

Validates the _mta-sts and _smtp._tls TXT records

Live Policy Fetch

Fetches and parses your policy file over HTTPS

Actionable Results

Clear pass / warn / fail on every requirement

Enforcement Status

Tells you whether TLS is enforced or still in testing

What is MTA-STS & how it works

How a domain enforces TLS on inbound email

MTA-STS (SMTP MTA Strict Transport Security) lets a domain tell sending mail servers that inbound email must be delivered over a valid, encrypted TLS connection. Without it, SMTP encryption is opportunistic and can be silently stripped by an attacker — MTA-STS closes that downgrade gap.

It works with two parts: a _mta-sts TXT record that advertises a policy id, and a policy file served over HTTPS at mta-sts.<domain> listing the allowed MX hosts and a mode. Its companion, TLS-RPT, asks providers to email you daily reports of any TLS failures. This checker validates both, fetches the live policy, and confirms every MX is covered.

Policy mode
enforce (block on TLS failure), testing (report only) or none (disabled).
mx:
A policy line naming an MX host allowed to receive mail; each MX must be covered.
TLS-RPT
A TXT record (rua=) that requests daily SMTP TLS failure reports.

How to use this tool

Validate a domain's MTA-STS in four steps
1
Enter a domain
Type a domain, e.g. example.com — the receiving domain whose policy you want to check.
2
Run the check
Click Check MTA-STS & TLS-RPT to read the DNS records and fetch the live HTTPS policy file.
3
Review the policy
See the policy mode, MX coverage, TLS-RPT reporting address, and the pass/warn/fail pipeline.
4
Fix and enforce
Apply the recommendations, then move the policy from testing to enforce once TLS reports are clean.

Learn more

Guides & explainers related to this tool

Guide

How to Set Up MTA-STS

Step-by-step: publish the policy file, DNS records, and move from testing to enforce.

Article

What Is MTA-STS?

How MTA-STS forces inbound email over valid TLS, and what each policy field means.

Article

What Is TLS-RPT?

How SMTP TLS reporting gives you daily visibility into TLS failures.

Related tools

Keep debugging with tools from the same suite
4 tools
MTA-STS & TLS-RPT Generator
Generate an MTA-STS policy file and the _mta-sts and TLS-RPT DNS records to enforce and monitor TLS on inbound email
DANE / TLSA Checker
Check DANE TLSA records for every MX host, verify the DNSSEC chain, and match records against the live mail server certificate
DMARC Lookup
Check DMARC policy records for email authentication, reporting, and policy enforcement
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records

Frequently asked questions

Common questions about MTA-STS
5 Q&A

MTA-STS (SMTP MTA Strict Transport Security) is a standard that lets a domain require inbound email be delivered over authenticated TLS, preventing attackers from downgrading or intercepting SMTP connections.

In testing mode, TLS failures are reported (via TLS-RPT) but mail is still delivered, so you can trial the policy safely. In enforce mode, senders refuse to deliver over a failed or invalid TLS connection. Move to enforce once reports are clean.

TLS-RPT (SMTP TLS Reporting) is a companion TXT record with an rua= address. It asks sending providers to email you daily aggregate reports of TLS negotiation successes and failures, giving visibility into delivery problems.

The policy file lists the MX hosts allowed to receive mail. If an MX is not matched by an mx: line, once the policy is in enforce mode senders will refuse to deliver through that host — so every MX must be covered or added.

Publish a _mta-sts TXT record with a policy id, host a policy file over HTTPS at mta-sts.yourdomain listing your MX hosts and a mode, and add a TLS-RPT record. Start in testing mode, watch the reports, then switch to enforce.