Skip to content
Emergency helpGet started
Back to Tools

MTA-STS Checker

Check a domain's MTA-STS record, its policy file and mode, and its TLS-RPT reporting record. The same scan grades SPF, DKIM, DMARC and the rest of the domain's email security.
Start a check
  • DNS-Based Scan
  • Non-Intrusive Analysis

What is MTA-STS?

MTA-STS (SMTP MTA Strict Transport Security, RFC 8461) lets a domain tell sending mail servers to deliver its mail only over authenticated TLS to the MX hosts it lists. It has two parts: a TXT record at _mta-sts followed by the domain, with v=STSv1 and an id, and a policy file at https://mta-sts followed by the domain at /.well-known/mta-sts.txt.

Without it, STARTTLS is opportunistic: an attacker who can delete the STARTTLS response or redirect the SMTP session can downgrade or intercept delivery (RFC 8461, section 1).

This checker looks up the TXT record, fetches the policy file over HTTPS and reads its mode, and checks the TLS-RPT record at _smtp._tls followed by the domain (RFC 8460). It does not test the MX hosts' certificates.

How the MTA-STS check scores the policy

80 or more is good, 50 to 79 is a warning and below 50 is bad. MTA-STS carries 10 of the 100 points in the overall email security grade and TLS-RPT carries 5.
mode: enforce
Full credit.
mode: testing
Scores 80.
mode: none
Scores 50.
No readable mode
A policy file without a mode the check can read scores 70.
No reachable policy file
A TXT record without a policy file the check can fetch scores 40.
TLS-RPT
A record with a rua reporting address scores 100, and 50 without one.

Common MTA-STS problems and how to fix them

These are the problems this checker detects, with the change that fixes each one.

Policy file not reachable

Senders need both the TXT record and the policy file. The file has to be served over HTTPS from the mta-sts host, with a certificate valid for that name.

Fix: Publish the file at /.well-known/mta-sts.txt on the mta-sts host, served as text/plain, and check that the host name resolves and its certificate is valid.

Testing mode left on

In testing mode, senders still deliver over connections that fail validation and only report the failures.

Fix: Once TLS-RPT reports show no failures, change the mode to enforce and change the id in the TXT record so senders fetch the new policy.

Policy mode set to none

none tells senders the domain has no active policy. RFC 8461 uses it to withdraw MTA-STS (section 8.3).

Fix: Use testing or enforce, unless you are retiring MTA-STS.

No MTA-STS record

Without MTA-STS, senders cannot tell that your domain expects authenticated TLS, so delivery can be downgraded.

Fix: Publish the policy file first, then the TXT record with a new id.

_mta-sts.example.com TXT "v=STSv1; id=20261018T000000"

No TLS-RPT reporting address

A TLS-RPT record without rua sends no reports, and without TLS-RPT you get no reports at all.

Fix: Publish v=TLSRPTv1 with a rua address at _smtp._tls for the domain.

_smtp._tls.example.com TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

MTA-STS policy file and records

_mta-sts TXT
v=STSv1 and an id of up to 32 letters and digits. Change the id whenever the policy changes.
version: STSv1
The first field of the policy file.
mode:
The policy mode: enforce, testing or none.
mx:
One line per MX host name or wildcard pattern, such as *.example.net.
max_age:
How long senders may cache the policy, in seconds, up to 31557600 (about a year).
_smtp._tls TXT
The TLS-RPT record: v=TLSRPTv1 and a rua address for reports about TLS failures.

Example policy file

version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800

Sources

More email authentication tools

Beyond DNS records

These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.

Managed SOCGet started
Questions

MTA-STS checker FAQ

What does an MTA-STS check do?

It looks up the TXT record at _mta-sts for the domain, fetches the policy file from https://mta-sts followed by the domain at /.well-known/mta-sts.txt and reads its mode. This one also checks the TLS-RPT record and runs the full email security scan.Email Security AnalyzerCompare the public security checks

What is the difference between enforce and testing mode?

In enforce mode, sending servers that implement MTA-STS must not deliver to a host that fails MX matching or certificate validation or does not support STARTTLS. In testing mode they deliver anyway and report failures through TLS-RPT. none means no active policy (RFC 8461, section 5).About email authentication

Where does the MTA-STS policy file go?

At https://mta-sts.example.com/.well-known/mta-sts.txt, using your own domain. The mta-sts host must present a valid certificate for that name (RFC 8461, section 3.3), and the file should be served as text/plain.About email authentication

Do I need TLS-RPT with MTA-STS?

TLS-RPT (RFC 8460) is a separate record, but testing mode depends on it: senders report policy failures only to domains that publish a TLS-RPT record (RFC 8461, section 5).About email authentication

Can I check MTA-STS through an API?

Yes. POST {"target":"example.com"} to https://vigilbase.com/api/v1/agent/tools/email-security/execute. The response holds the full email security result, with MTA-STS under result.details.records.mtaSts and TLS-RPT under result.details.records.tlsRpt.Run a check through the public APIAPI authentication and rate limits