Free MTA-STS Checker
Validate MTA-STS Policy & TLS-RPT Configuration
Check any domain's MTA-STS policy and TLS-RPT setup to catch missing or misconfigured records.
Run a live MTA-STS lookup to validate your DNS record, hosted policy file, and TLS configuration in one check.
About Free MTA-STS Checker by DMARKOFF
Our Free MTA-STS Checker validates every component required for a working MTA-STS deployment.
It checks your DNS records, retrieves the hosted policy file, verifies TLS reporting, and confirms everything is configured correctly.
If something is missing or misconfigured, you'll see exactly what's wrong and how to fix it.
What Is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain publish a policy telling sending mail servers to require encrypted, authenticated TLS connections when delivering email. It works through a TXT record and a hosted policy file together, so sending servers can confirm the policy is authentic and know exactly which mail servers to trust.
TLS-RPT (Transport Layer Security Reporting) is a companion mechanism defined in RFC 8460, published as a TXT record at _smtp._tls.{domain}, that lets sending servers report back when a TLS connection fails, giving you visibility into delivery and encryption problems.
What the MTA-STS Checker Detects
✓ Confirms your domain exists and has valid name servers
✓ Confirms an MTA-STS TXT record exists at _mta-sts.{domain}
✓ Validates the record's syntax, version, and policy ID
✓ Confirms the hosted policy file is reachable over HTTPS at the required URL
✓ Confirms a TLS-RPT TXT record exists at _smtp._tls.{domain}
✓ Validates the TLS-RPT record's syntax and reporting address
✓ Provides the exact fix for every issue detected
Benefits of Regular MTA-STS Checks
• Confirm your MTA-STS policy is published correctly
• Verify your hosted policy file is accessible
• Detect configuration issues before they affect mail delivery
• Ensure TLS reports are sent to the correct address
• Strengthen inbound email security against downgrade attacks
Why Choose Free MTA-STS Checker
Free to use — no signup required to conduct an MTA-STS check
Instant validation — DNS records and policy file checked together.
Session history — compare results across multiple domains during your session.
FAQ
MTA-STS lets your domain require encrypted TLS connections for incoming mail, preventing attackers from silently downgrading a connection to unencrypted SMTP. Without it, sending servers fall back to opportunistic encryption, which can be intercepted or stripped.
Not strictly, but they work best together. MTA-STS enforces secure TLS connections for incoming email, while TLS-RPT reports when those connections fail. Publishing both helps protect email in transit and makes it easier to detect delivery or encryption problems.
An MTA-STS TXT record is published at _mta-sts.yourdomain.com and contains two required tags:
• v=STSv1 — identifies the protocol version and must appear first.
• id= — a unique identifier that changes whenever you update the hosted policy file, allowing sending mail servers to detect and reload the new policy.
Publish a TXT record at _mta-sts.{domain} with a valid v=STSv1; id= value, then host a policy file at https://mta-sts.{domain}/.well-known/mta-sts.txt defining your enforcement mode and allowed mail servers.
Several issues can prevent MTA-STS from working correctly, even if you've published a TXT record. Common problems include a missing or invalid MTA-STS record, an unreachable policy file, incorrect policy syntax, an outdated id= value after updating the policy, the policy file not being served over HTTPS, or a mismatch between the DNS record and the hosted policy. The checker identifies the exact issue and shows how to fix it.