MTA-STS & TLS-RPT
Check a domain’s MTA-STS policy and TLS-RPT record, or generate both for your mail servers.
About the MTA-STS & TLS-RPT
MTA-STS tells other mail servers that your domain supports encrypted delivery and that they should refuse to fall back to plain text. Without it, email between servers is usually encrypted opportunistically, which an attacker on the network path can quietly downgrade. MTA-STS closes that gap, and TLS-RPT sends you daily reports whenever a sender could not deliver securely, so you find problems before your users do.
The checker reads your _mta-sts DNS record, fetches the policy file from mta-sts.yourdomain/.well-known/mta-sts.txt, and compares the policy against your real MX records. It flags the failures that matter most: a missing or invalid record, a policy that redirects, an MX host the policy does not list, and a policy still in testing mode. It also checks for the TLS-RPT record that delivers failure reports.
The Generate tab produces the DNS records and the policy file for your mail servers. It starts in testing mode on purpose: watch the TLS reports for a few weeks, then switch to enforce. Authentication records are checked separately by Email Health, and you can grade the whole setup with the Email Deliverability Score.
Reach the developers and engineers who use these tools every day.
Frequently asked questions
What is the difference between MTA-STS and TLS-RPT?
MTA-STS is the policy: it says your servers support TLS and that senders must use it. TLS-RPT is the reporting channel: senders email you a daily summary of any connection that failed. They work best together.
Why start in testing mode?
In enforce mode a sender refuses to deliver if it cannot verify your mail server, so a typo or an expired certificate means lost mail. Testing mode reports the same failures without blocking delivery, which lets you fix problems safely first.
Where does the policy file have to be hosted?
At https://mta-sts.yourdomain/.well-known/mta-sts.txt, on a host with a valid TLS certificate for that name. Redirects are not allowed. Any web server or static host that can serve a text file will do.
How do I update the policy later?
Edit the file, then change the id value in the _mta-sts TXT record. Senders cache the policy for max_age seconds and only re-fetch when they see a new id. The generator uses a timestamp so each id is unique.
Does MTA-STS replace DANE?
No. DANE does the same job using DNSSEC and is common in some regions. MTA-STS needs no DNSSEC and works through ordinary web hosting, which is why it is more widely deployed. Some domains publish both.