Email Security Check free
Email Security Check / MTA-STS and TLS-RPT checker

MTA-STS and TLS-RPT checker

MTA-STS forces encrypted delivery of mail to your domain. This checker looks up the _mta-sts TXT record, downloads the policy file over HTTPS and reads its mode.

DKIM selector (optional)

We test 50 common selectors. If your provider uses its own, find s= in the DKIM-Signature header of an email you sent and enter it here.

How to set up MTA-STS

  1. Host a file at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate:
    version: STSv1
    mode: testing
    mx: *.example-mx.com
    max_age: 86400
  2. Add TXT _mta-sts.example.com with v=STSv1; id=20260101. Change the id every time the policy changes.
  3. Add TXT _smtp._tls.example.com with v=TLSRPTv1; rua=mailto:tls@example.com.
  4. When reports look clean, switch to mode: enforce and raise max_age to 604800 or more.

Frequently asked questions

Does MTA-STS replace SPF, DKIM or DMARC?

No. Those prove who sent a mail. MTA-STS protects mail coming to you in transit, by requiring encryption with a valid certificate.

More from Email Security Check

More free security tools

Password GeneratorStrong passwords, passphrases and PINs, made in your browser.Password Leak CheckHas your password been leaked? Check privately against 900+ million breached passwords.One-Time SecretShare passwords with a self-destructing, end-to-end encrypted link.Link Safety CheckIs this link safe? Check for phishing before you click.SiteSentryWebsite security grade A to F: HTTPS, headers, cookies, leaks.