Back to Toolkit

MTA-STS Verification

Lookup and verify MTA-STS (Mail Transfer Agent Strict Transport Security) DNS records and policy files for your domain.

1 Enter Domain
2 Lookup
3 Assess Record
4 Generate MTA-STS
SorbSecurity Product
Sender Discovery — Monitor MTA-STS alongside DMARC, SPF, and DKIM. TLS reporting and encrypted transport from one dashboard.
Get Started Free
Try sample
DNS TXT query: _mta-sts.example.com
How It Works
1

Enter Domain

Provide the domain to check

2

DNS + Policy Lookup

We query _mta-sts.domain and fetch the policy file

3

Assess Configuration

Evaluate DNS record and policy against best practices

4

Generate MTA-STS

Create an optimized configuration if issues are found

What is MTA-STS?

MTA-STS (RFC 8461) allows a domain to declare that it supports TLS for inbound SMTP connections and that sending servers should refuse to deliver mail over an unencrypted channel.

It requires two components: a DNS TXT record at _mta-sts.yourdomain.com and a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.

MTA-STS Policy Modes
  • enforce Strongest — reject mail if TLS cannot be established
  • testing Moderate — report failures via TLS-RPT but still deliver
  • none Disabled — signals MTA-STS is not active