Staaarter Tools

MTA-STS Checker

Looks up a domain's _mta-sts DNS TXT record and attempts a direct fetch of its .well-known/mta-sts.txt policy file, so you can see whether MTA-STS is actually configured end to end. A free online tool from Staaarter, right in your browser.

Runs locallyUpdated 2026-07-25
lookupliveemail

Overview

Introduction

SMTP was designed to fall back to unencrypted delivery whenever anything about a TLS connection looks wrong, which is exactly the gap MTA-STS closes for domains that opt in.

This tool checks both halves of an MTA-STS setup: the DNS TXT record that advertises it, and a live attempt to fetch the actual policy file it points to.

What Is MTA-STS Checker?

An MTA-STS adoption checker that looks up the _mta-sts TXT record for a domain and tries to fetch its published policy file over HTTPS.

It's part of this site's DNS & Domain Tools collection; the DNS lookup and the policy fetch are both real, live requests.

How MTA-STS Checker Works

The tool queries a public DNS-over-HTTPS resolver for the domain's _mta-sts TXT record and parses out its version and policy ID.

It then attempts a direct browser fetch of https://mta-sts.<domain>/.well-known/mta-sts.txt; if the server allows cross-origin reads, the actual policy content (mode, MX hosts, max age) is shown.

When To Use MTA-STS Checker

Use it after publishing MTA-STS for your own domain, to sanity-check that the DNS record and policy file agree before flipping the policy to 'enforce'.

It's also useful for checking whether a partner or vendor domain you send sensitive mail to has MTA-STS configured at all.

Often used alongside DKIM Record Checker and MX Record Lookup.

Features

Advantages

  • Checks the DNS advertisement and the actual policy file, not just one half of the setup.
  • Surfaces the policy ID directly, useful for confirming a recent policy update actually took effect.

Limitations

  • The policy file fetch commonly fails from a browser due to CORS, even for correctly configured domains; a failed fetch there isn't conclusive on its own.
  • Doesn't validate the policy content against the domain's actual MX records, only whether it could be fetched and what it contains.

Examples

A domain with MTA-STS correctly configured

Input

example.com

Output

TXT record: found (id=20260101000000)
Policy file: fetched
version: STSv1
mode: enforce
mx: mail.example.com

Both the DNS advertisement and the policy file resolved successfully and agree on the domain's mail servers.

Best Practices & Notes

Best Practices

  • Start a new MTA-STS policy in 'testing' mode and watch TLS-RPT reports before switching to 'enforce', since a misconfigured enforce policy can silently block legitimate mail.
  • Keep the policy's mx list in sync with your actual MX records; a mismatch causes sending servers to refuse delivery under enforce mode.

Developer Notes

TXT record parsing strips the quote-delimited chunking that DNS-over-HTTPS JSON APIs return for TXT data before matching against the 'v=STSv1' prefix, since a policy ID long enough to split across multiple quoted segments would otherwise fail the match.

MTA-STS Checker Use Cases

  • Verifying your own domain's MTA-STS DNS record and policy file agree after a change
  • Checking whether a vendor or partner domain supports MTA-STS before treating an email from them as authenticated
  • Debugging a suspected MTA-STS misconfiguration during a mail delivery incident

Common Mistakes

  • Treating a failed policy-file fetch here as proof the domain's MTA-STS is broken, when it's often just this browser's CORS restriction.
  • Publishing a policy file without a working TXT record (or vice versa), leaving MTA-STS half-configured.

Tips

  • If the policy fetch fails here, run `curl https://mta-sts.<domain>/.well-known/mta-sts.txt` from a terminal to get a CORS-free answer.

References

Frequently Asked Questions