Check a domain
How it works
Three DNS lookups
The STS record, the TLS-RPT record and the A or CNAME for the mta-sts host, over DNS-over-HTTPS.
Policy fetch
The browser tries https://mta-sts.domain/.well-known/mta-sts.txt. It only succeeds when the server sends a CORS header; if not, you get the link and a checklist.
Policy is parsed
version, mode, max_age and every mx: line are validated, then each real MX host is matched against the patterns.
Verdict per line
Anything that would stop a sending server enforcing TLS is a fail; testing mode and missing reporting are review items.
The problem MTA-STS solves
SMTP encrypts opportunistically. A sending server offers STARTTLS; if the receiver accepts, the session is encrypted; if anything interferes — a misconfiguration, or an attacker on the path stripping the offer — it falls back to plaintext and nobody is told. MTA-STS lets a receiving domain publish a policy that says: my mail servers support TLS, here are their names, and if you cannot establish a valid TLS session to one of them, do not deliver. TLS-RPT is the companion that tells you when that happens.
The three parts, and where they break
The DNS record at _mta-sts.yourdomain is trivial: v=STSv1; id= followed by any string that changes when the policy does. Its only job is to tell senders a policy exists and whether to re-fetch it. Forgetting to bump the id after editing the policy file means senders keep the old one until max_age expires.
The policy file lives at https://mta-sts.yourdomain/.well-known/mta-sts.txt, served with a valid certificate for that exact hostname. It lists version, mode, one mx: line per accepting host or wildcard, and max_age in seconds. The mx patterns must cover every MX record the domain publishes; a host that is not listed cannot be used, so a policy that misses your secondary MX silently reduces your redundancy.
TLS-RPT at _smtp._tls.yourdomain names an address that receives daily JSON reports of TLS failures from Google, Microsoft and others. Without it, enforce mode is flying blind: if your certificate expires, mail stops and you find out from customers.
Testing to enforce
Start in mode: testing with TLS-RPT publishing. Senders will evaluate the policy and report failures without changing delivery. After two weeks of clean reports — and they will be clean if your MX is Google or Microsoft — switch to enforce, bump the id, and set max_age to a week or two. A year is the maximum and is too long; if you ever need to change MX providers you want old policies to expire quickly.
Why the browser might not read your policy
Sending mail servers fetch the policy directly and have no cross-origin restrictions. Browsers do. Unless your policy host sends an Access-Control-Allow-Origin header the tool cannot read the file, which is a limitation of the check, not a problem with the policy. The result links to the file so you can confirm it by eye. If you serve the policy from a Cloudflare Worker or similar, adding the header costs one line and makes the check complete.
Frequently asked questions
Do I need MTA-STS for cold email?
It protects inbound mail to you, not outbound from you, so it does not change deliverability. It does contribute to the overall picture a domain presents, and the deliverability score tool includes it for that reason. Set it up on the primary domain; it is optional on sending domains.
What should max_age be?
One to two weeks in enforce mode. Long enough that senders cache it and short enough that an MX migration is not held hostage by old policies.
My MX is Google Workspace. What mx: lines do I need?
One: mx: smtp.google.com — or, if you use the five-host set, mx: *.aspmx.l.google.com plus mx: aspmx.l.google.com. Microsoft 365 needs mx: *.mail.protection.outlook.com.
Where do TLS-RPT reports go?
To the mailto: address in the record. They are gzip JSON, one per reporting domain per day. A dedicated mailbox or a DMARC reporting service that also handles TLS-RPT keeps them out of your inbox.
Does DANE replace MTA-STS?
DANE does the same job using DNSSEC instead of HTTPS, and is preferred by some European receivers. The two coexist; senders that support both try DANE first. Most domains without DNSSEC start with MTA-STS because it needs nothing beyond a web host.
The policy file check failed but the file is fine.
If the failure reason mentions CORS or a network error, the browser was blocked from reading it and the policy is probably fine. If it mentions a specific line — version, mode, max_age, an uncovered MX — that is a real finding.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.