MTA-STS checker
Check every link in your MTA-STS setup: the TXT record, the policy file, its certificate, your MX hosts, max_age and TLS reporting. Then see whether you are ready to enforce. Free, no signup.
Reads public DNS and your public policy file only: nothing is changed and no email is sent.
What the check reads
Six links, and enforce needs every one.
- TXT record
- _mta-sts.yourdomain announces the policy. Its id= changes whenever the policy does, so senders know to fetch it again.
- Policy file
- https://mta-sts.yourdomain/.well-known/mta-sts.txt, as text/plain, with version, mode, mx: lines and max_age.
- Certificate
- The policy host needs a valid, trusted certificate for mta-sts.yourdomain, or senders ignore the policy.
- MX hosts
- Every MX host must match an mx: line. Under enforce, senders refuse to deliver to a host that does not.
- max_age
- How long senders keep the policy. A week or more keeps it in place between fetches; the limit is a year.
- TLS reporting
- _smtp._tls.yourdomain says where senders report TLS failures: how you see what enforce would block. MTA-STS explained.
Questions, answered
Before you enforce.
What is MTA-STS?
A policy that tells other mail servers to deliver to you only over encrypted, authenticated TLS. Without it, an attacker on the path can strip encryption and read or redirect your incoming mail.
What does an MTA-STS setup need?
A TXT record at _mta-sts.yourdomain with an id, and a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt served over a valid certificate. The policy lists your MX hosts, a mode and a max_age. A TLS reporting record at _smtp._tls.yourdomain tells senders where to report failures.
When is it safe to switch from testing to enforce?
When every MX host is listed in the policy, the certificate is valid, and your TLS reports show no failures for a couple of weeks. In testing mode senders only report problems; in enforce mode they refuse to deliver over a connection that fails.
Why do I need to change the id?
Senders cache your policy for max_age seconds and fetch it again only when the id in the TXT record changes. Change the id every time you change the policy file.