A standard (RFC 8461) that tells sending mail servers to deliver to your domain only over TLS with a valid certificate, to the MX hosts your policy names, instead of falling back to plain text.

What is an MTA-STS record?

A DNS TXT record at _mta-sts.yourdomain.com, such as v=STSv1; id=20261017. It says a policy exists; the id tells senders when the policy file has changed.

It isn't required by Gmail, Yahoo or Microsoft's bulk sender rules, and mail flows without it. It protects mail sent to you from downgrade and interception, so it is worth adding once SPF, DKIM and DMARC are in place.

For most domains, yes: it is a small static file and two TXT records, and it closes the STARTTLS downgrade gap. Start in testing mode so a mistake can't block mail.

What is the MTA-STS policy file?

A text file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with version, mode, mx and max_age lines. It must be served as text/plain with HTTP 200 and no redirect.

What is MTA-STS and TLS-RPT?

MTA-STS tells senders to require TLS to your MX hosts. TLS-RPT (RFC 8460) is a TXT record at _smtp._tls that tells them where to send reports when those TLS connections fail.

What is the difference between MTA-STS and DANE?

Both stop TLS downgrades. DANE publishes certificate details in DNS and needs DNSSEC; MTA-STS uses an HTTPS-hosted policy and the normal certificate system, so it works without DNSSEC.

Does MTA-STS work with Office 365?

Yes. Exchange Online honours other domains' MTA-STS policies when sending, and you can publish your own with mx: *.mail.protection.outlook.com to cover Microsoft 365's MX hosts.

MTA-STS checker: test the record, the policy file and your MX hosts

An MTA-STS checker tests the three parts a sending server reads under RFC 8461: the _mta-sts TXT record with its id, the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, and whether every MX host matches the policy's mx lines. This one also checks the mode, max_age and the TLS-RPT record that reports failures.

Reads _mta-sts and _smtp._tls from public DNS and fetches the policy file the way a sending server would. 10 checks a minute.

SimpleAPI

Sample result

acme.example has an MTA-STS policy, but it's still in testing mode.

MTA-STS policy: acme.example
max_age: 604,800 s
MX hosts: All match

What this means for you

Testing only reports problems; switch to enforce so senders must deliver to you encrypted.

Next step:Generate an enforce policy

Reads the _mta-sts and TLS-RPT records
Fetches the policy file like a sender does
Checks every MX host against the mx lines
Flags redirects, bad ids and short max_age

MTA-STS
TLS
MX

By SimpleVerifier Team · Last updated October 17, 2026

How do I check an MTA-STS policy?

Enter the domain that receives the mail, such as yourdomain.com. A host starting mta-sts. works too.
Press Check MTA-STS. The tool reads _mta-sts and _smtp._tls from public DNS and resolves the MX hosts.
It fetches the policy file once over HTTPS with certificate checks and no redirects, as a sending server would, and validates each line.
Fix anything marked red, change the id in the TXT record whenever you edit the policy, and run the check again. With no policy, copy the starter policy it suggests.

Example

You enter: The domain acme.example.
You get: The _mta-sts record is valid and the policy file is fetched, but its mode is testing, so it warns. max_age is 604,800 seconds, every MX host matches the policy's mx lines, and a TLS-RPT record is published.
Limits: One domain per check and 10 checks a minute per connection. It doesn't connect to the MX hosts on port 25.

What is MTA-STS?

MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain tell sending servers to deliver its mail only over TLS with a valid certificate, to MX hosts it names. Without it, SMTP encryption is opportunistic: an attacker who can interfere with the connection can strip STARTTLS and the sender quietly falls back to plain text. RFC 8461 defines it.

It has two parts. A DNS TXT record at _mta-sts.yourdomain.com, v=STSv1; id=..., says a policy exists. The policy file itself is served over HTTPS from mta-sts.yourdomain.com, so it is protected by the web PKI rather than by DNS, which is what lets it work without DNSSEC.

How do I check if MTA-STS is working?

Check all three pieces, because mail keeps flowing when one breaks and nothing tells you. The TXT record must be the only v=STSv1 record and carry an id of 1 to 32 letters and digits. The policy URL must return HTTP 200 as text/plain, over a certificate valid for the mta-sts host, without a redirect. And every MX host must match an mx line, or senders in enforce mode will refuse to deliver.

In our MTA-STS adoption study of 1,359 major domains, seven of the 58 that published the record had a policy file senders couldn't fetch: no DNS for the mta-sts host, an expired certificate, a timeout or an HTTP error. A broken policy fails open, so those domains had no protection without knowing it.

How do I set up MTA-STS?

Serve a policy file, publish the TXT record, then add TLS-RPT. The file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt holds four kinds of line: version: STSv1, mode: testing, one mx: line per MX host (a leading *. matches one label, so *.mail.protection.outlook.com covers Microsoft 365), and max_age: in seconds. Then publish _mta-sts TXT v=STSv1; id=20261017 and change the id every time the file changes, or senders keep the cached copy.

Google documents the steps for Workspace in set up MTA-STS and TLS reporting, and Microsoft for Exchange Online in enhancing mail flow with MTA-STS. Any static host with a certificate for the mta-sts subdomain can serve the file.

What is the difference between MTA-STS testing and enforce mode?

In testing mode, senders that support MTA-STS still deliver when TLS validation fails, but report the failure through TLS-RPT; in enforce mode they refuse to deliver over a connection that fails. Start in testing, read the reports for a week or two, then switch to enforce and change the id. mode: none withdraws a policy.

TLS-RPT (RFC 8460) is the TXT record at _smtp._tls.yourdomain.com, v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com, that tells senders where to send daily reports of failed TLS connections. Without it, testing mode tells you nothing.

MTA-STS testing vs enforce vs none

	testing	enforce	none
TLS failure	Deliver anyway, report it	Refuse to deliver	No policy applies
MX host not in policy	Deliver anyway, report it	Refuse to deliver	No policy applies
mx lines required	Yes	Yes	No
When to use it	First weeks, while reading TLS-RPT	Once reports are clean	To withdraw MTA-STS

Who uses this tool, and for what?

IT admins: Confirm a new MTA-STS setup before switching from testing to enforce, and catch an expired certificate on the mta-sts host.
MSPs and agencies: Audit a client's domain in one pass: record, policy file, MX coverage and TLS-RPT, with the exact fix for each failure.
Email migrations: After moving to a new mail provider, check the policy's mx lines still cover the new MX hosts before enforce mode blocks mail.
Security reviews: Show which domains rely on opportunistic TLS only, as part of a supplier or compliance check.

What can’t this tool tell you?

It checks the policy as published. It doesn't connect to your MX hosts on port 25 or test their certificates; we don't open SMTP connections.
The fetch comes from our server; a policy host that blocks some networks or regions may answer differently for real senders.
Senders cache a policy for max_age seconds, so a fix takes effect only after they refetch, which the changed id prompts.
It reads TLS-RPT's record, not the reports themselves.

Common questions

What is MTA-STS?: A standard (RFC 8461) that tells sending mail servers to deliver to your domain only over TLS with a valid certificate, to the MX hosts your policy names, instead of falling back to plain text.
What is an MTA-STS record?: A DNS TXT record at _mta-sts.yourdomain.com, such as v=STSv1; id=20261017. It says a policy exists; the id tells senders when the policy file has changed.
Do I need MTA-STS?: It isn't required by Gmail, Yahoo or Microsoft's bulk sender rules, and mail flows without it. It protects mail sent to you from downgrade and interception, so it is worth adding once SPF, DKIM and DMARC are in place.
Is MTA-STS worth it?: For most domains, yes: it is a small static file and two TXT records, and it closes the STARTTLS downgrade gap. Start in testing mode so a mistake can't block mail.
What is the MTA-STS policy file?: A text file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with version, mode, mx and max_age lines. It must be served as text/plain with HTTP 200 and no redirect.
What is MTA-STS and TLS-RPT?: MTA-STS tells senders to require TLS to your MX hosts. TLS-RPT (RFC 8460) is a TXT record at _smtp._tls that tells them where to send reports when those TLS connections fail.
What is the difference between MTA-STS and DANE?: Both stop TLS downgrades. DANE publishes certificate details in DNS and needs DNSSEC; MTA-STS uses an HTTPS-hosted policy and the normal certificate system, so it works without DNSSEC.
Does MTA-STS work with Office 365?: Yes. Exchange Online honours other domains' MTA-STS policies when sending, and you can publish your own with mx: *.mail.protection.outlook.com to cover Microsoft 365's MX hosts.

Sources

Authentication and capacity are half of deliverability.

The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.

Bulk verification with real SMTP mailbox checks
Hard bounces removed before a send, not discovered after
Catch-all, disposable and role detection on every row

Get started — $29.99/mo See the published limits first

One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.