Skip to content
tlspeek

Mail

MTA-STS checker

Read the DNS id and the policy file that tell other mail servers to use TLS when they deliver to this domain.

Enter a domain. The check reads _mta-sts and one HTTPS policy file. The name is not stored.

MTA-STS tells other mail servers to use TLS when they deliver mail to you, and to deliver only to hosts you named. It has two pieces. A TXT record at _mta-sts carries v=STSv1 and an id. A text file at https://mta-sts.<domain>/.well-known/mta-sts.txt carries the policy: a version, a mode, one or more mx patterns, and max_age in seconds. Receivers that support the standard fetch the file over HTTPS and cache it until max_age, or until the id in DNS changes.

This check reads that TXT record and fetches that one HTTPS file. The file host is mta-sts plus your domain, on port 443. The name is resolved first. If it points at a private or reserved address, the fetch is not made. Redirects are followed only when the next URL is still https on port 443 and still public, and only a few times. The body is capped, because a policy file is short.

How to read mode and mx

mode none means do not enforce. mode testing means report failures and still deliver. mode enforce means a supporting receiver should refuse mail that is not delivered with TLS to a host matching an mx line. An mx line is a host name, or a wildcard of one label such as *.example.com, which matches mail.example.com and does not match a.b.example.com or example.com itself. max_age tells the receiver how long it may cache the file. A day is a common floor. More than about a year is not allowed.

The id in DNS is not a secret. It is a signal. When you change the policy file, change the id so receivers know the cached copy is stale. The check also compares your published MX hosts to the patterns in the file. A host that receives mail and is not in the policy will fail once you enforce.

Common mistakes

  • Publishing the TXT record and forgetting the HTTPS file, or the reverse. Both are required.
  • Serving the file over HTTP, or on a name other than mta-sts. The location is fixed.
  • Setting enforce while a backup MX is missing from the policy. Mail to that backup starts failing.
  • Leaving mode at testing forever. Testing does not stop a downgrade.
  • Forgetting to change the id after editing the file, so receivers keep the old policy until max_age ends.

MTA-STS is about the path mail takes to your servers. HSTS is about browsers. SPF is about who may send. Read the MX list beside this result so the three descriptions of your mail servers agree.

FAQ

Does enforce stop all spoofing?

No. It tells supporting receivers to use TLS when they deliver mail to you. It does not sign your outbound mail. SPF, DKIM, and DMARC do that job.

What if the policy file redirects?

A redirect is followed only when it stays on public HTTPS port 443. A redirect to a private address or another port stops the check.

How long should max_age be?

At least a day, and not more than about a year. Longer caches mean a bad policy sticks around. The id lets you expire a cache early.

Why compare MX hosts?

The policy should name the same servers that MX publishes. A mismatch is a delivery failure waiting for enforce mode.

Is the domain stored?

No. The DNS query and the policy fetch use it only to build this answer.