Tools
MTA-STS checker.
Validate an MTA-STS setup end to end: DNS record, HTTPS policy file and MX coverage.
How to read your results
Three parts have to agree. The _mta-sts DNS record (with an id), the HTTPS policy file at mta-sts.yourdomain.com, and your MX hosts. Every MX host has to be covered by an mx line in the policy.
Mode matters. testing reports TLS problems but still delivers; enforce rejects mail that can't be delivered over valid TLS. Roll out in testing first, then promote to enforce.
It complements DMARC, not replaces it. DMARC stops spoofing of your domain; MTA-STS protects mail in transit to it. Pair it with TLS-RPT to get failure reports.
Checking everything at once? The domain security scan runs MTA-STS alongside DMARC, SPF, DKIM and more.
Frequently asked questions
- What is MTA-STS?
- MTA-STS (SMTP MTA Strict Transport Security) tells sending servers to require encrypted TLS delivery to your domain and to refuse delivery without a valid certificate. It closes a downgrade-attack gap that plain STARTTLS leaves open.
- How do I check my MTA-STS setup?
- Enter your domain. dmarcula checks the _mta-sts DNS record, fetches the policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, and confirms it covers your MX hosts.
- What is the difference between MTA-STS testing and enforce mode?
- In testing mode, failures are reported (via TLS-RPT) but mail still delivers, so you can roll out safely. In enforce mode, mail that cannot be delivered over valid TLS is rejected. Start in testing, then move to enforce.
- Do I need MTA-STS if I already have DMARC?
- They solve different problems. DMARC stops spoofing of your domain; MTA-STS protects mail in transit to your domain from interception. Strong setups use both.
This check is a snapshot. dmarcula watches your domain around the clock, reads the DMARC reports for you, and emails you when something changes. Free, no credit card.