# Free MTA-STS Record Checker

Verify your Mail Transfer Agent Strict Transport Security (MTA-STS) configuration to prevent man-in-the-middle attacks.

Check MTA-STS

### **What Is MTA-STS?**

MTA-STS (Mail Transfer Agent Strict Transport Security) is defined in RFC 8461 and ensures that emails sent to your domain are always encrypted in transit using TLS. Without MTA-STS, even if your mail server supports TLS, a man-in-the-middle attacker can perform a downgrade attack — stripping the TLS negotiation and intercepting messages in plain text. This is known as an SMTP downgrade attack. MTA-STS eliminates this vulnerability by publishing a policy that instructs sending mail servers to only deliver email over an authenticated, encrypted TLS connection to your specified MX hosts.

### **What Our Checker Validates**

Our tool validates both components of MTA-STS. First, it checks the DNS TXT record at [_mta-sts.yourdomain.com_](http://mta-sts.yourdomain.com/) _for a valid 'id' field (which signals policy updates to sending servers). Second, it fetches and validates the policy file at [https://mta-sts.yourdomain.com/.well-known/mta-sts.txt](https://mta-sts.yourdomain.com/.well-known/mta-sts.txt) — checking the mode (testing, enforce, or none), MX hostname entries, max_ age value, and HTTPS certificate validity. Common issues flagged include mismatched MX entries between the policy file and actual DNS, expired certificates on the mta-sts subdomain, and excessively short max_age values.

### **MTA-STS and Your Security Stack**

While DMARC, SPF, and DKIM protect against domain spoofing, MTA-STS protects the email content during delivery by ensuring TLS encryption is enforced. This is especially critical for organizations in regulated industries — finance, healthcare, government, and legal — where unencrypted email transmission creates compliance risks. MTA-STS works alongside TLS-RPT (which provides reporting on TLS negotiation outcomes) and optionally DANE (which uses DNSSEC to publish TLS certificates). For most organizations, MTA-STS combined with TLS-RPT provides the most practical path to transport encryption enforcement.

## Frequently Asked Questions

**What is MTA-STS?**  
MTA-STS (Mail Transfer Agent Strict Transport Security) is a protocol that forces emails to be sent over a secure TLS connection, preventing man-in-the-middle attacks.

**How does MTA-STS work?**  
It uses a DNS record to signal that the domain supports MTA-STS and an HTTPS policy file to specify the enforcement policy.

**Do I need MTA-STS?**  
Yes, strict MTA-STS helps ensure that your emails are not intercepted or read by unauthorized parties during transit.

**What is the difference between MTA-STS testing and enforce mode?**  
Testing mode asks sending servers to report TLS failures via TLS-RPT without enforcing the policy — email is still delivered even if TLS fails. Enforce mode instructs senders to reject delivery if TLS cannot be negotiated with your specified MX hosts.

**What is the max_age setting?**  
max_age specifies how long (in seconds) sending servers should cache your MTA-STS policy. Common values are 604800 (1 week) or 86400 (1 day). Longer values reduce DNS lookups but delay policy updates.

**Do I need a separate SSL certificate for mta-sts subdomain?**  
Yes. The mta-sts.yourdomain.com subdomain must serve the policy file over HTTPS with a valid, publicly trusted TLS certificate. A wildcard certificate covering \*.yourdomain.com works.

**Does MTA-STS require DMARC?**  
No, MTA-STS and DMARC are independent protocols solving different problems. DMARC authenticates sender identity; MTA-STS enforces transport encryption. Both are recommended for comprehensive email security.