Check your domain's MTA-STS policy
Check the MTA-STS TXT record and policy file for any domain: mode, max_age, and whether every MX host is covered.
Set up TLS-RPT reportsMTA-STS (RFC 8461) tells other mail servers that mail to your domain must be delivered over TLS with a valid certificate, and only to the MX hosts you list. Without it, an attacker on the network can strip encryption from incoming mail or send it to a different server.
This checker reads the TXT record at _mta-sts.yourdomain, fetches the policy file from https://mta-sts.yourdomain/.well-known/mta-sts.txt, and shows the mode, the max_age, and whether every MX host of the domain matches an mx: line in the policy.
How to read the result
- mode: enforce: senders that support MTA-STS refuse to deliver unless TLS and the certificate check pass. This is full protection.
- mode: testing: senders deliver as usual but report failures (if TLS-RPT is set up). Start here.
- mode: none: the policy is switched off.
- MX not matched: one of your real MX hosts is not covered by an mx: line. In enforce mode, senders will not deliver to that host.
- Not found: there is no _mta-sts TXT record, or the policy file cannot be fetched over HTTPS.
The two parts you must publish
First, a TXT record at _mta-sts.yourdomain with v=STSv1 and an id. Change the id each time you change the policy, so senders fetch the new one. Second, a text file served over HTTPS at mta-sts.yourdomain/.well-known/mta-sts.txt, with a valid certificate for mta-sts.yourdomain. Many teams host the file on a static host or a small Cloudflare Worker.
Example
Policy file for Google Workspace (served at https://mta-sts.example.com/.well-known/mta-sts.txt)
version: STSv1 mode: testing mx: smtp.google.com mx: *.aspmx.l.google.com max_age: 86400
And the TXT record: _mta-sts.example.com TXT "v=STSv1; id=20261026T000000". Move to mode: enforce and a longer max_age (for example 604800) after a few weeks without TLS-RPT failures.
Common problems and fixes
Frequently asked questions
Does MTA-STS protect the email I send?
No. It protects mail sent to your domain. It tells other servers how to deliver to you. Your outbound TLS depends on your own mail server or provider.
Do Gmail and Microsoft support MTA-STS?
Yes. Gmail and Microsoft 365 respect MTA-STS policies when they deliver to your domain, and both publish policies for their own domains.
Should I start in enforce mode?
No. Start in testing mode with TLS-RPT turned on. Move to enforce when reports show no TLS failures, usually after two to four weeks.
Why does the policy need its own HTTPS site?
Senders fetch the policy from https://mta-sts.yourdomain. That host name needs a DNS record and a valid certificate, even if the file is the only thing on it.
What does max_age mean?
How long, in seconds, senders may cache the policy. Use a short value (one day) in testing and a longer one (one to several weeks) in enforce mode.