MTA-STS and TLS reporting checker
Type your domain. We read the MTA-STS record, fetch the policy file and check its mode, mail servers and max_age, then the TLS reporting record, each with the fix.
What you get
- The _mta-sts record and whether it is in the required form.
- The policy file at mta-sts.yourdomain: whether it loads over HTTPS without a redirect.
- The policy mode (enforce, testing or none) and max_age.
- Whether every one of your mail servers is covered by the policy, so enforce mode does not refuse your own mail.
- The _smtp._tls reporting record, so you hear about failed secure connections.
Common questions
Does a small business need MTA-STS?
It is optional. SPF, DKIM and DMARC matter far more and come first. MTA-STS adds protection against someone downgrading the connection between mail servers, which matters most for businesses that receive sensitive documents by email.
Will enforce mode block my email?
Only if the policy does not list your mail servers or their certificates are invalid. Start in testing mode with TLS reporting on, read the reports for two weeks, then switch to enforce.
Microsoft 365 and Google support it?
Both check MTA-STS when they send to you. To publish your own policy you host a small text file on mta-sts.yourdomain over HTTPS; many DNS and hosting providers can serve it for you.
Get told when it changes
Add the site to a free account and we check it every five minutes, with certificate, domain and email security alerts in plain English.