MTA-STS checker

What MTA-STS protects against

Ordinary SMTP negotiates encryption opportunistically (STARTTLS) and falls back to plaintext if that fails or is stripped by an attacker in transit - a known downgrade weakness. MTA-STS (RFC 8461) lets a domain publish a policy that tells sending servers "always use TLS to reach my mail servers, and only these specific ones," removing the silent-fallback option entirely for servers that support it.

Two independent pieces, both checked

• DNS discovery - a TXT record at _mta-sts.domain that exists mainly to signal a policy update via its id= value.
• The HTTPS policy - the actual rules, fetched from https://mta-sts.domain/.well-known/mta-sts.txt: which mode (enforce/testing/none), how long to cache it, and which MX hostnames are covered.

Redirects on the policy fetch are reported as a warning rather than followed - RFC 8461 expects a direct, successful fetch, and several real-world implementations treat a redirect there as a failure.

Why the MX cross-check matters

A policy that does not list every MX host the domain actually uses leaves those uncovered - mail routed to them gets no MTA-STS protection at all, silently. This is compared directly against the domain's live MX records rather than trusted at face value.

Related tools

See TLS-RPT checker for the companion reporting mechanism, and MX lookup for the domain's mail servers directly.