CalculatorsEmail Deliverability
← Back to Free Tools Hub
RFC 8461 / 8460

Free MTA-STS Checker & TLS Enforcement Tester

Published by Fred Dawson | Category: DNS & Auth | Free Web Application
Security Rate Limit: 5 free uses / IP / 24 hours

Verify that senders can discover and enforce TLS for mail to your domain. This checker resolves the _mta-sts TXT record, fetches the /.well-known/mta-sts.txt policy over fully verified HTTPS, reports the enforcement mode, mx patterns and max_age, and checks whether TLSRPT failure reporting is configured.

🔒 SMTP In-Transit Encryption

MTA-STS & TLS Reporting Protocol Auditor

Inspect whether your domain enforces strict TLS encryption against Man-in-the-Middle (MITM) downgrade attacks under RFC 8461, and verify TLS failure reporting under RFC 8460.

Tool Overview: What It Does & Core Purpose

Traditional Simple Mail Transfer Protocol (SMTP) relies on opportunistic TLS via the `STARTTLS` command, leaving email exchanges vulnerable to Man-in-the-Middle (MITM) downgrade attacks and eavesdropping. Mail Transfer Agent Strict Transport Security (MTA-STS, RFC 8461) eliminates this vulnerability by mandating TLS encryption and certificate validation across sending and receiving mail servers. The **AutoSMTP MTA-STS Checker** inspects your DNS announcement, downloads your HTTPS policy file, and validates SMTP TLS Reporting (TLSRPT, RFC 8460) compliance.

Key Advantages & Architectural Benefits

Advantage

**Mitigates STARTTLS Downgrade Exploits:** Confirms whether external MTAs are mandated to reject plaintext transmission when connecting to your servers.

Advantage

**Dual-Channel Verification:** Probes both DNS TXT records (`_mta-sts` and `_smtp._tls`) and the independent HTTPS policy endpoint.

Advantage

**MX Pattern Alignment:** Verifies that your published MX server hostnames match the allowed patterns in the MTA-STS policy directive.

Advantage

**Policy Mode Insight:** Distinguishes between exploratory monitoring (`mode: testing`) and strict cryptographic enforcement (`mode: enforce`).

Email Marketing & Cold Outreach Integration

How This Tool Accelerates Email Campaigns & Deliverability

Enterprise organizations dealing with financial, healthcare, or confidential business outreach require guaranteed in-transit confidentiality. Implementing MTA-STS signals superior infrastructure hygiene to receiving mailbox algorithms. AutoSMTP bare-metal PowerMTA and KumoMTA clusters support native TLS 1.3 encryption with pre-configured MTA-STS policy endpoints.

Frequently Asked Questions (FAQs)

How does MTA-STS prevent eavesdropping? ▾

In standard SMTP, an attacker on the network wire can strip the `STARTTLS` handshake command, forcing the sending MTA to transmit the email in plaintext. MTA-STS instructs senders ahead of time that TLS is non-negotiable; if TLS cannot be negotiated, delivery is halted.

What is the purpose of TLSRPT (RFC 8460)? ▾

TLS Reporting provides automated telemetry. If an external server cannot establish a secure TLS connection with your mail server, it sends aggregate JSON diagnostic reports to your designated `rua` email address.

Can I host my mta-sts.txt file on any web server? ▾

Yes, but it must be served over valid HTTPS (no self-signed certificates) at the exact URI `https://mta-sts.[yourdomain]/.well-known/mta-sts.txt`.

What is the recommended max_age directive? ▾

During initial deployment in `mode: testing`, use a short `max_age` such as 86400 (1 day). Once fully verified, elevate to `mode: enforce` with a `max_age` of 604800 (1 week) or 1209600 (2 weeks).

Enterprise Email Architecture
Need Automated High-Volume Sending Infrastructure?

Free tools help you audit and optimize individual elements, but sustained enterprise email delivery requires dedicated bare-metal infrastructure. AutoSMTP replaces fragile shared relays with private bare-metal PowerMTA and KumoMTA clusters configured automatically in 15 minutes.

Turnkey Dedicated Bare-Metal Clusters

Provisions fully licensed PowerMTA/KumoMTA clusters on enterprise bare-metal with flat predictable pricing and zero third-party markups.

Automated Gas-Pedal IP Warming

Monitors Google Postmaster spam ratios (<0.10%) and real-time deferrals across clean IPv4 subnets to scale daily send limits safely.

Native FBL & Socket Interceptors

RFC 5321 in-band 550 bounce suppression + automated Yahoo/Outlook CFL ingest to protect sender score automatically.

Fully Managed DNS & Auth

Pre-configured rDNS/PTR, SPF, 2048-bit DKIM, strict DMARC, and BIMI integration synchronized across your domain portfolio.

Deploy Your Dedicated Email Infrastructure Today

Stop risking your sender reputation on shared pools. Get dedicated IPv4 subnets, custom reverse DNS, and automated deliverability engineering.

Explore Dedicated MTA Clusters →

Key capabilities

  • STSv1 record detection
  • Policy file fetched with real certificate validation
  • mode: enforce / testing / none
  • TLSRPT (SMTP TLS Reporting) presence.

Frequently asked questions

What does MTA-STS protect against?

TLS downgrade and MITM attacks on inbound SMTP: when enforced, senders must refuse delivery over unauthenticated or invalid-certificate connections.

Should I start in testing mode?

Yes — publish mode: testing with TLSRPT first, watch failure reports for a week, then switch to enforce.

Related tools