Free MTA-STS checker · Instant · No signup

MTA-STS Checker

Validate your MTA-STS setup. Domain Doctor checks your _mta-sts DNS record and fetches your policy file to confirm TLS is enforced for inbound mail.

19 checks per scan Results in seconds Free, no signup

The tool

What the MTA-STS Checker checks

MTA-STS (SMTP MTA Strict Transport Security) forces sending mail servers to use encrypted, authenticated TLS when delivering to your domain, closing the door on downgrade and man-in-the-middle attacks.

It has two parts that must agree: a _mta-sts TXT record with a policy ID, and a policy file served at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Domain Doctor validates both and checks the mode (enforce, testing or none), the listed MX hosts, and the max_age.

How it works

Check your domain in three steps

1Enter your domainType any domain into the box above and start the free scan. No signup, no software.

2We inspect it liveDomain Doctor checks your MTA-STS DNS record and policy file, in real time from our servers.

3Get a clear verdictYou get a plain-language result, the exact records we found, and a concrete fix if anything is wrong.

What to watch for

Common MTA-STS Checker problems

DNS record present but policy file missing or unreachable
Mode stuck in testing instead of enforce
Policy MX list not matching your real MX records
Policy served without a valid certificate on mta-sts subdomain
max_age too short to be effective

VASTROX Email Security

Enforce encrypted mail delivery

We publish your MTA-STS policy and TLS-RPT and host the policy file on a correctly certified subdomain.

MTA-STS in enforce mode
Valid policy file on your mta-sts subdomain
TLS-RPT reporting enabled

Set up MTA-STS Talk to VASTROX about email

Hosting, VPS, business email and game servers. Free migration. Real support.

Questions

Frequently asked

Do I need MTA-STS if I already have DMARC?

They solve different problems. DMARC stops spoofing; MTA-STS enforces TLS on the delivery connection. Strong domains use both.

What mode should MTA-STS use?

enforce provides real protection. testing only reports failures without blocking. Start in testing, then move to enforce once your MX and policy match.