Free Tool

MTA-STS Checker

Verify your domain's MTA-STS configuration. Check DNS records and policy files to ensure encrypted email delivery.

Free instant check — no signup required

What is MTA-STS?

Mail Transfer Agent Strict Transport Security (MTA-STS) is a security mechanism defined in RFC 8461 that allows email domain owners to declare that their mail servers support TLS encryption and to specify a policy for how sending servers should handle messages when a secure connection cannot be established.

Without MTA-STS, SMTP email delivery is vulnerable to downgrade attacks where an attacker can strip the STARTTLS command from the connection, forcing email to be sent in plaintext. MTA-STS solves this by providing an out-of-band mechanism (via HTTPS) for receiving domains to advertise their TLS capability and enforce encryption requirements.

MTA-STS works alongside TLS-RPT (TLS Reporting), which provides visibility into TLS connection failures. Together, they help domain owners ensure that email to their domain is always encrypted in transit and quickly identify any delivery issues caused by TLS configuration problems.

Frequently Asked Questions

What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) is a security standard (RFC 8461) that enables email domains to declare their ability to receive TLS-encrypted connections and to specify whether sending servers should refuse to deliver email if a secure connection cannot be established. It prevents downgrade attacks and man-in-the-middle attacks on email in transit.
How does MTA-STS protect email?
Without MTA-STS, an attacker can perform a STARTTLS downgrade attack: intercepting the SMTP connection and stripping the STARTTLS command, forcing email to be transmitted in plaintext. MTA-STS prevents this by publishing a policy over HTTPS that tells sending servers to require TLS. Since the policy is fetched over HTTPS (which is itself protected by the CA certificate system), it cannot be stripped.
How do I implement MTA-STS?
You need two things: a DNS TXT record at _mta-sts.yourdomain.com with the value 'v=STSv1; id=YYYYMMDD01' (where id is any unique identifier you update when the policy changes), and an HTTPS-served policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt specifying 'version: STSv1', 'mode: enforce', 'mx: mail.yourdomain.com', and 'max_age: 604800'.
What's the difference between MTA-STS and STARTTLS?
STARTTLS is an SMTP extension that offers to upgrade a connection to TLS — but it's optional and can be stripped by an attacker. MTA-STS is an out-of-band policy mechanism that tells sending servers they MUST use TLS and should refuse delivery if they can't establish a secure connection. STARTTLS is opportunistic; MTA-STS makes TLS enforcement mandatory.
Does MTA-STS affect email delivery?
Once you set MTA-STS to 'enforce' mode, sending servers that cannot establish a TLS connection to your mail server will defer delivery rather than send in plaintext. This means if your TLS certificate expires or your mail server has TLS misconfigured, legitimate email could be delayed. Start with 'testing' mode and use TLS-RPT reports to monitor for issues before switching to 'enforce'.

Need continuous MTA-STS monitoring?

Get automatic alerts when your MTA-STS configuration changes or breaks. Monitor MTA-STS, SPF, DKIM, DMARC, and 60 blacklists.

Start Monitoring Free