MTA-STS Checker

What is MTA-STS?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

MTA-STS tells sending mail servers that your domain's MX hosts support TLS with valid certificates, and that they should refuse to deliver over a downgraded connection. It needs a _mta-sts TXT record and a policy file served over HTTPS. This checker finds the record, fetches the policy and reads its mode.

SMTP encryption between servers is opportunistic by default: an attacker who strips STARTTLS from the conversation can force plain-text delivery. MTA-STS closes that gap for senders that support it, such as Gmail and Microsoft 365.

The policy file is fetched from https://mta-sts.yourdomain/.well-known/mta-sts.txt with a 5-second timeout and normal certificate checks, exactly as a sending server would.

How do I check MTA-STS for a domain?

Enter the domain that receives mail, for example example.com.
Check that the TXT record exists and the policy file was fetched.
Compare the mx lines in the policy with your real MX records yourself; mail to an MX not covered by the policy fails in enforce mode.

How to read the results

DNS record: The v=STSv1 TXT record at _mta-sts.yourdomain. Its id= value must change every time you change the policy, so senders know to fetch it again.
Policy: The parsed policy file: version, mode (enforce, testing or none), mx host patterns and max_age in seconds.
Findings: No record (info), a policy file that couldn't be fetched (warning), and a mode of testing or none (warning).

Common MTA-STS problems

Policy file could not be fetched

mta-sts.yourdomain needs an A or CNAME record, an HTTPS server, and a certificate valid for that exact name. A 404 means the file isn't at /.well-known/mta-sts.txt.

Policy changes are ignored

Senders cache the policy for max_age seconds and refetch only when the id= in the TXT record changes. Update the id whenever you edit the file.

_mta-sts.example.com. TXT "v=STSv1; id=20261023T1200"

Mail fails after switching to enforce

An MX host isn't matched by any mx line, or its certificate doesn't cover its name. Fix the policy or the certificate, and use TLS-RPT reports to find which.

Examples and command-line equivalents

A complete policy file

version: STSv1
mode: enforce
mx: mail.example.com
mx: *.mail.example.net
max_age: 604800

Fetch the policy yourself

dig +short TXT _mta-sts.example.com
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt

Frequently asked questions

Should I start in testing or enforce mode?

Start with mode: testing alongside TLS-RPT reporting, confirm no failures are reported for a few weeks, then switch to enforce.

What max_age should I use?

One week (604800) is common while you settle in; RFC 8461 allows up to 31557600 (about a year). Longer values protect better between fetches but make mistakes last longer.

Does MTA-STS replace DANE?

They solve the same problem differently. DANE needs DNSSEC and TLSA records; MTA-STS needs only HTTPS. Some domains publish both.