MTA-STS and TLS-RPT Checker
Type a domain. The DNS record only says a policy exists; this goes and reads it, checks whether it enforces anything, and compares its mail servers with the ones the domain actually publishes.
The record is a signpost, not the policy
_mta-sts.yourdomain says one thing: “a policy exists, go and read it”. Every checker for this looks at that record, finds it, and calls you covered. The policy behind it can be a 404, a host whose certificate nobody renewed, a mode that enforces nothing, or a list of servers that stopped being yours two migrations ago. In all four the record is there and the protection is not.
What this does not tell you
Whether your mail is encrypted today. MTA-STS stops a sending server from silently falling back to plain text when something tampers with the connection — it is about the attack, not about the everyday case, where opportunistic TLS already works. And it covers mail coming IN to you; it says nothing about what you send.
If you are here, this is usually what comes next
The whole mail setup, in one report
This reads two records and one file. Mail Doctor adds SPF, DKIM, DMARC, the MX, the reverse DNS and the blacklists, scores it out of ten and puts the fixes in the order that matters.
Frequently asked questions
- My DNS record is there. Why does this say I have no policy?
- Because the record and the policy are two different things in two different places, and the second one is the one that does the work. The most common cause by far is the certificate on the mta-sts. host: it is a separate name, it does not get renewed with the main one, and the moment it expires every sending server stops being able to read your policy — while the DNS record sits there looking healthy. The exact reason is in the report.
- Is testing mode good enough to start with?
- It is the right way to start and a bad place to stay. Testing exists so that senders report what would have failed without bouncing real mail, which is exactly what you want for a few weeks. But it enforces nothing, so a domain left in testing has the appearance of protection and none of it — and that is the state most domains that bothered are in, including several very large ones.
- Do I need TLS-RPT as well?
- It is the half that tells you when your policy broke something. Without it, a mistake in the policy — a server you forgot to list, an expired certificate — looks exactly like silence: mail stops arriving from some senders and nobody tells you why. One TXT record and an address to receive the reports.