Open Terminal

MTA-STS Lookup

Available

Verify a domain’s MTA-STS setup: the _mta-sts TXT record and the HTTPS policy file, including mode, MX patterns and max age.

MTA-STS Lookup

Domain name

Open in terminal
Try:

How it works

The server reads the TXT record at _mta-sts.<domain>, then fetches https://mta-sts.<domain>/.well-known/mta-sts.txt and checks that its mx patterns match the domain’s MX records.

Safeguards & responsible use

  • Only public domain names are accepted; internal names (.local, .internal, …) are rejected.
  • Queries go to public resolvers, never to internal DNS.
  • Per-client rate limiting and query timeouts.
  • Policy fetches use HTTPS only, follow no redirects (as RFC 8461 requires) and are size and time limited.

Frequently asked questions

What does MTA-STS do?

It tells sending servers to require valid TLS when delivering to your MX hosts, preventing downgrade and interception attacks.

Should I start with mode: enforce?

Start with mode: testing plus TLS-RPT reporting, then switch to enforce once reports are clean.