Free MTA-STS checker · Instant · No signup
MTA-STS Checker
Validate your MTA-STS setup. Domain Doctor checks your _mta-sts DNS record and fetches your policy file to confirm TLS is enforced for inbound mail.
VASTROX HOSTING · EMAIL · DNS · SSL
Want VASTROX to fix every issue above — for you?
Don't fix it alone. Our team configures your SPF, DKIM, DMARC, SSL, DNS and security headers correctly, then hosts you on fast NVMe infrastructure so your domain scores an A and stays there.
- Every failing check fixed and verified
- Hosting, business email, DNS & SSL under one roof
- Free migration from your current provider
What this checks
MTA-STS (SMTP MTA Strict Transport Security) forces sending mail servers to use encrypted, authenticated TLS when delivering to your domain — closing the door on downgrade and man-in-the-middle attacks.
It has two parts that must agree: a _mta-sts TXT record with a policy ID, and a policy file served at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Domain Doctor validates both and checks the mode (enforce, testing or none), the listed MX hosts, and the max_age.
Common MTA-STS Checker errors
- DNS record present but policy file missing or unreachable
- Mode stuck in testing instead of enforce
- Policy MX list not matching your real MX records
- Policy served without a valid certificate on mta-sts subdomain
- max_age too short to be effective
VASTROX EMAIL SECURITY
Enforce encrypted mail delivery with MTA-STS
We publish your MTA-STS policy and TLS-RPT and host the policy file on a properly certified subdomain.
- MTA-STS in enforce mode
- Valid policy file on mta-sts subdomain
- TLS-RPT reporting enabled
Trusted by businesses for hosting, VPS, business email & game servers · Free migration · Real support
Frequently asked questions
Do I need MTA-STS if I already have DMARC?
They solve different problems. DMARC stops spoofing; MTA-STS enforces TLS on the delivery connection. Strong domains use both.
What mode should MTA-STS use?
enforce provides real protection. testing only reports failures without blocking. Start in testing, then move to enforce once your MX and policy match.