MTA-STS
See whether a domain requires encrypted mail delivery via MTA-STS.
About MTA-STS
What it is
MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that forces mail servers to encrypt the connection when delivering mail to your domain. It is published via a DNS record and an https policy file.
Why it matters
Without MTA-STS, mail can in theory be delivered unencrypted if an attacker manages to downgrade the TLS negotiation. MTA-STS prevents that by ensuring sending servers never accept delivery without working encryption.
Tips
- MTA-STS also requires a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.
- Start with mode=testing to monitor without blocking, then switch to mode=enforce.
- Combine it with TLS-RPT to receive reports about delivery problems.
Common questions
Is MTA-STS the same as STARTTLS?
No. STARTTLS is the protocol that encrypts the connection, MTA-STS is the policy that forces STARTTLS and prevents downgrade attacks.
Do I need MTA-STS if I already have DMARC?
They protect against different things. DMARC protects against sender spoofing, MTA-STS protects against eavesdropping on mail traffic in transit.
More lookups
MX lookup
See which servers receive mail for a domain, and which provider handles it.
SPF check
Check whether a domain has an SPF record and how strictly it rejects spoofed mail.
DMARC check
See whether a domain has DMARC and which policy it uses against spoofed mail.
DKIM check
Look for DKIM signing on a domain using the most common selectors.
DNSSEC check
See whether a domain is protected with DNSSEC, that is, whether its DNS answers are signed.
TXT lookup
List all TXT records for a domain, including SPF, verifications and more.
NS lookup
See which name servers control a domain's DNS.
Blacklist check
Check whether a domain's IP address is on blacklists such as Spamhaus, Barracuda and SpamCop.
A/AAAA lookup
See which IP addresses a domain points to, both IPv4 (A) and IPv6 (AAAA).
CNAME lookup
See whether a domain is an alias that points on to another domain.
SOA lookup
See the zone's core data: primary name server, contact and serial number.
CAA lookup
See which certificate authorities are allowed to issue certificates for the domain.
Reverse DNS (PTR)
Look up which host name a domain's IP address points back to.
TLS-RPT
See whether a domain receives reports about failed encrypted mail delivery.
BIMI
See whether a domain publishes a logo that can be shown in the recipient's inbox.
SSL certificate
Check a domain's TLS certificate: issuer, validity and expiry.
Whois
See who owns a domain, when it was registered and when it expires.
HTTP security headers
Check whether a domain's website sets important security headers.