How to Check MTA-STS Before You Switch to Enforce

Before you switch MTA-STS from testing to enforce, check four things: the _mta-sts record, the policy file, that every MX host is covered by the policy, and that TLS-RPT reports show no failures. Paste your domains into the bulk MTA-STS checker for the first three; your TLS-RPT reports cover the fourth.

Check MTA-STS on a list of domains →

Check them in bulk

1. Open the bulk MTA-STS checker.
2. Paste the domains, one per line: up to 100 a run, or 500 after a free Google sign-in.
3. Press Check MTA-STS. Each domain's _mta-sts and _smtp._tls records and MX records are read, and the policy file is fetched once over HTTPS.
4. Read each row: Enforced, Testing, Off, Broken or Not set up, with the mode, max_age, any MX host the policy doesn't cover and the TLS-RPT address.
5. Any domain marked Broken, or with an uncovered MX, isn't ready to enforce.

Do it by hand

The record and the policy file, here for a domain in testing mode:

dig +short txt _mta-sts.fastmail.com
# "v=STSv1; id=20260728T132000"

curl -s https://mta-sts.fastmail.com/.well-known/mta-sts.txt
# version: STSv1
# mode: testing
# mx: *.messagingengine.com
# max_age: 86400

Then check every MX host against the policy's mx: lines (run with bash):

d=fastmail.com
pol=$(curl -s https://mta-sts.$d/.well-known/mta-sts.txt | tr -d '\r')
for mx in $(dig +short mx $d | awk '{print $2}' | sed 's/\.$//'); do
  ok=no
  for p in $(echo "$pol" | awk '/^mx:/{print $2}'); do
    [ "$mx" = "$p" ] && ok=yes
    [ "${p#\*.}" != "$p" ] && [ "${mx#*.}" = "${p#\*.}" ] && ok=yes
  done
  echo "$mx covered=$ok"
done
# in2-smtp.messagingengine.com covered=yes
# in1-smtp.messagingengine.com covered=yes

And the certificate each MX presents, which the policy depends on:

openssl s_client -starttls smtp -connect in1-smtp.messagingengine.com:25 \
  -verify_hostname in1-smtp.messagingengine.com -verify_return_error -brief < /dev/null 2>&1 | grep -E "Verification|Peer certificate"
# Peer certificate: CN=*.messagingengine.com
# Verification: OK

We ran these on 9 November 2026. The wildcard test follows RFC 8461, section 4.1: *.example.com matches mail.example.com "but not example.com or foo.bar.example.com". Many home and office networks block outbound port 25, so the openssl step may need to run from a server. The bulk checker doesn't test MX certificates; this command does.

What to fix before enforcing

• An MX not covered. Add an mx: line for it. RFC 8461, section 5 says that in enforce mode senders "MUST NOT deliver the message to hosts that fail MX matching or certificate validation or that do not support STARTTLS." This bites after adding a backup MX or moving mail providers.
• Policy file not loading. It must answer HTTP 200 on mta-sts.<domain> with a valid certificate for that name. The RFC says "HTTP 3xx redirects MUST NOT be followed", so a redirect to www counts as no policy.
• No TLS-RPT. Publish _smtp._tls.<domain> with v=TLSRPTv1; rua=mailto:... (RFC 8460). In testing mode, reports are the only way to see failures.
• Switching. Change mode: testing to mode: enforce in the policy file first, then change the id in the TXT record so senders fetch the new policy. Section 8.1 gives that order, so senders never pair a new id with the old file. max_age can be at most 31557600 seconds (a year); RFC 8461 expects weeks or more once you're confident.

Most domains don't publish MTA-STS at all; see our MTA-STS adoption study. To write the records, use the MTA-STS generator.

Next step: check the addresses you send to

MTA-STS protects mail on its way into your domain. The bounces that hurt your sending come from the addresses on your own list. Upload it at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: audit your domain's email authentication, SPF, DKIM and DMARC explained.