Bulk MTA-STS checker: record, policy mode and TLS-RPT for up to 500 domains
In short: Paste domains and see each one's _mta-sts record, whether the policy file loads over HTTPS, its mode (enforce, testing or none), whether the MX hosts match, and whether TLS-RPT is set up. Limit: It checks what senders can see: DNS and the policy file. It doesn't test the TLS certificates on the mail servers themselves.
A bulk MTA-STS checker tests the MTA-STS setup of many domains at once. Paste up to 100 domains, or 500 after a free Google sign-in, and each row shows whether the _mta-sts TXT record exists, whether the policy file loads over HTTPS, its mode (enforce, testing or none), whether every MX host matches the policy, and whether a TLS-RPT record is published. CSV out.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
acme.example enforces MTA-STS and every MX host matches; globex.example has none.
- Domain
- acme.example
- max_age
- 604800
- MX hosts
- All covered
What this means for you
Enforce mode makes senders refuse delivery over a connection that fails TLS checks.
- _mta-sts record and policy file
- Mode, max_age and MX matching
- TLS-RPT report address
- 100 a run, 500 signed in; CSV
- MTA-STS
- TLS-RPT
- Enforce
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français · Türkçe · 简体中文 · Русский · Nederlands · Italiano · Tiếng Việt · Bahasa Indonesia · Polski · العربية · Українська · Čeština · Magyar · 日本語 · 한국어
Auditing the mail setup of a list of domains?
- MTA-STS protects mail in transit to a domain. It says nothing about whether a particular mailbox there exists. To check the addresses on a list, upload it at /verify.
- The first 100 email checks are free with a Google sign-in, no card. For SPF, DKIM and DMARC on the same domains, run the bulk email authentication checker.
How do I check MTA-STS on many domains at once?
- Paste domains, one per line, up to 100 a run, or 500 after a free Google sign-in. Email addresses and URLs work too; the domain is taken from each.
- Press Check MTA-STS. For each domain the tool reads the
_mta-stsand_smtp._tlsTXT records and the MX records, then requests the policy file once fromhttps://mta-sts.<domain>/.well-known/mta-sts.txt, ten domains a request. - Read each row: Enforced, Testing, Off, Broken or Not set up, with the mode, max_age, any MX host the policy doesn't cover, and the TLS-RPT report address.
- Filter to domains that need work and download the CSV with every check's result and reason.
Example
- You enter
- Two domains:
acme.example(MTA-STS in enforce mode) andglobex.example(no MTA-STS record). - You get
- acme.example: Enforced, with the record id, the policy's max_age, every MX host matched and the TLS-RPT report address. globex.example: Not set up, no v=STSv1 record. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 domains a request; DNS plus one HTTPS fetch of each policy file, no SMTP connection.
What does a bulk MTA-STS check look at?
MTA-STS, defined in RFC 8461, lets a domain tell sending servers to deliver its mail only over TLS with a valid certificate. It has two parts: a TXT record at _mta-sts.<domain> with an id, and a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt listing the mode, max_age and the MX hosts allowed.
For each domain this tool checks there is exactly one v=STSv1 record with a valid id, fetches the policy file over HTTPS with certificate checks and no redirects (the RFC forbids following them), parses it, and compares every MX host with the policy's mx lines. It also reads the TLS-RPT record at _smtp._tls.<domain> (RFC 8460), where sending servers report TLS failures.
What do the results mean?
Enforced: the record, the policy file and every MX host check out, in mode enforce, so senders that support MTA-STS refuse to deliver over a connection that fails TLS checks. Testing: the same, but senders only report failures and still deliver. Off: mode none, the policy is switched off.
Broken means a record exists but something stops senders from using it, such as a policy file that doesn't load, an invalid certificate on the mta-sts host or an MX host the policy doesn't cover, which in enforce mode can block real mail. Not set up means there is no v=STSv1 record, which is the case for most domains.
Should every domain have MTA-STS?
It's optional and no mailbox provider requires it to receive your mail. It's worth setting up on domains that receive important mail, and it's most useful with TLS-RPT, so you see failures before you enforce. Start in testing mode, read the reports, then switch to enforce.
For one domain with the full policy file and a fix for each problem, use the single MTA-STS checker, and the MTA-STS generator to write the records.
Why does the policy file fail to load for some domains?
The most common reasons are that mta-sts.<domain> doesn't resolve, that its certificate doesn't cover that name, that it redirects (to a www host or a login page), or that it answers anything other than HTTP 200. Senders treat each of those as no policy.
Each request identifies itself as SimpleVerifier, reads at most 64 KB, waits up to eight seconds and never connects to private addresses. A site that blocks automated requests can fail here while loading in a browser; the row's reason says what we saw.
How is this different from the single MTA-STS checker?
| Bulk MTA-STS checker | MTA-STS checker | |
|---|---|---|
| Domains per run | 100, or 500 signed in | One |
| Policy file | Fetched and parsed | Fetched, parsed and shown in full |
| MX matching and TLS-RPT | One row per domain | Each check explained, with fixes |
| CSV export | Yes | No |
Who uses this tool, and for what?
- Email admins
- Confirm MTA-STS is in the mode you expect on every domain you run, and catch MX changes the policy no longer covers.
- Agencies
- Audit client domains in one run and send each a list of what's missing.
- Security teams
- Find domains whose policy file or certificate broke, which in enforce mode can block real mail.
- Deliverability consultants
- Add MTA-STS and TLS-RPT columns to a domain audit next to SPF, DKIM and DMARC.
What can’t this tool tell you?
- It checks what senders can see: DNS and the policy file. It doesn't test the TLS certificates on the mail servers themselves.
- Sites that block automated requests can fail the policy fetch while loading in a browser.
- The TLS-RPT column reads the record; it doesn't test each report destination.
- No SMTP connection is made, so nothing about the mail servers' behaviour is tested.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check MTA-STS for many domains?
- Paste the domains into a bulk MTA-STS checker like this one. Each row shows the record, the policy file, its mode, MX matching and TLS-RPT, and you can download the results as CSV.
- Is this bulk MTA-STS checker free?
- Yes. Up to 100 domains a run without an account, and up to 500 a run when you sign in with Google, with no card.
- What is the difference between testing and enforce?
- In testing mode senders report TLS failures but still deliver the mail. In enforce mode they refuse to deliver over a connection that fails the TLS checks.
- Does it check TLS-RPT too?
- Yes. It reads the v=TLSRPTv1 record at _smtp._tls for each domain and shows where reports go. For a full check of the report destinations, use the TLS-RPT checker.
- Does it connect to the mail servers?
- No. It reads DNS records and fetches the policy file from the mta-sts web host. It never opens an SMTP connection to the domains' mail servers.
- Why does a domain show Not set up?
- It has no v=STSv1 TXT record at _mta-sts, so senders never look for a policy. Most domains don't have one; it's an optional extra protection.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.