MTA-STS checker

Must other servers use encryption when they send you email, or can they fall back to plain text?

Live lookupPlain English + technicalFree, no sign-up

How to read the results

Mode enforce is the goal; testing only reports problems.
Every MX host must match an mx: line in the policy.

Check everything at once

The health check runs this and 30 more checks on a domain, then ranks what to fix.

Guides for auditors

Compliance checks

Domain audit Domain security audit ISO 27001 domain compliance check SOC 2 domain security check Cyber security compliance check

More in Email authentication

SPF checkValidate SPF and count the 10 DNS lookups.
DKIM checkFind DKIM keys and check their strength.
DMARC checkRead the DMARC policy and reporting setup.
BIMI checkCheck your brand logo record for inboxes.
TLS-RPT checkCheck you get reports when secure delivery fails.
DANE / TLSACheck TLSA records for your mail servers.
SPF / DMARC / DKIM / BIMI generatorsBuild SPF, DMARC, DKIM, BIMI and MTA-STS records.

About the MTA-STS check

Check a domain’s MTA-STS record and policy file: mode, max age, and whether the listed MX hosts match the real mail servers.

Every result comes in two styles: plain English for everyone, and the exact technical detail for engineers, with the raw JSON one click away.

Questions

Yes, it tells you when MTA-STS blocks or fails a delivery.