MTA-STS Checker

MTA-STS (Mail Transfer Agent Strict Transport Security) is an email security standard that allows domain owners to declare that their incoming mail servers support TLS and that sending mail servers should refuse to deliver email if a secure TLS connection cannot be established. It prevents downgrade attacks where an attacker strips TLS from the SMTP connection. MTA-STS requires both a DNS TXT record and a policy file hosted at a well-known HTTPS URL.

STARTTLS is an opportunistic encryption mechanism — if the receiving server supports it, the connection is upgraded to TLS, but if the upgrade fails (e.g. due to an attacker intercepting the connection), the email may still be sent unencrypted. MTA-STS enforces TLS — if the connection cannot be secured as specified in the policy, the sending server aborts delivery entirely. MTA-STS eliminates the downgrade attack that opportunistic STARTTLS is vulnerable to.

The MTA-STS policy is a text file hosted at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. It specifies the policy mode (none, testing, or enforce), the maximum age the policy should be cached, and the list of authorised MX hostnames. The file must be served over HTTPS with a valid certificate. The DNS TXT record at _mta-sts.yourdomain.com provides a policy ID that senders use to detect policy changes.

In testing mode, sending servers fetch and evaluate the MTA-STS policy but do not refuse delivery if TLS cannot be established — they only send failure reports to the TLS-RPT address. In enforce mode, sending servers must abort delivery if the MX hostname does not match the policy or if a valid TLS connection cannot be established. Start in testing mode, monitor TLS-RPT reports for failures, then switch to enforce once you are confident all your MX servers support TLS correctly.