MTA-STS (Mail Transfer Agent Strict Transport Security), defined in RFC 8461, lets a domain declare that other mail servers must use STARTTLS with a valid certificate when delivering email to it. It closes a long-standing gap where opportunistic TLS could be stripped or downgraded by an attacker on the path.
It works through two pieces of DNS and HTTPS. First, a TXT record at _mta-sts.<domain> publishes a policy version and an id that changes whenever the policy updates. Second, a policy file is served over HTTPS at https://mta-sts.<domain>/.well-known/mta-sts.txt, listing the permitted MX hosts and a mode.
The mode can be testing, where failures are reported but mail is still delivered, or enforce, where a sending server must abort delivery if TLS or certificate validation fails. A none mode withdraws the policy. Operators usually start in testing, watch TLS-RPT reports, then move to enforce.
MTA-STS protects mail in transit and complements DMARC, which protects against spoofing. Use the checker below to confirm the DNS record and policy file match and parse correctly.
Check it on your domain
- MTA-STS Checker: checks the MTA-STS record and the hosted policy file.
- TLS-RPT Checker: validates the TLS-RPT reporting record.
- MX Record Checker: looks up the mail servers for a domain.