How this check works
We query the TXT record at _mta-sts.<domain> and accept exactly one record that begins with “v=STSv1;” and has an id of 1–32 letters or digits (RFC 8461, section 3.1).
The policy is fetched from https://mta-sts.<domain>/.well-known/mta-sts.txt the way a sending server fetches it: the certificate must be valid for that name, redirects are not followed, and the response must be HTTP 200 and no larger than 64 KB. We resolve the name ourselves and connect only to public addresses.
Every mx pattern is compared with the domain’s MX records using the RFC’s wildcard rule, where “*.” matches exactly one label. In enforce mode, an MX host that no pattern covers does not receive mail from senders that apply your policy. We also read the TLS-RPT record, which is how you learn about failures.
Limitations
- We check the policy and its HTTPS host, not the certificates of your MX hosts. The SMTP and TLS test covers those.
- Senders cache a policy for max_age seconds and fetch a new one only after the id in the DNS record changes.
- Checked domains are not stored or logged.
Frequently asked questions
What is MTA-STS?
A way for a domain to tell sending servers that its mail servers support TLS with valid certificates, and that mail must not be delivered over an unencrypted or unauthenticated connection. It consists of a DNS record and a policy file on an HTTPS website (RFC 8461).
Should I start in testing or enforce mode?
Start with mode testing and a TLS-RPT record. The reports show whether senders could validate your mail servers. Switch to enforce once they show no failures, and keep max_age at a week or more.
Why must the policy URL not redirect?
RFC 8461 forbids senders to follow redirects when they fetch the policy, so a redirect makes your domain look as if it had no policy. Serve the file directly from mta-sts.<domain>.
What happens when I change the policy file?
Senders keep their cached copy until max_age expires unless the id in the DNS record changes. Update the file first, then change the id.
Do I need MTA-STS with Google Workspace or Microsoft 365?
Their servers support TLS, but MTA-STS is published by your domain, not by the provider. You host the policy file yourself (or through a service) and list the provider’s MX host names in it.