Back to Free Tools

    TLS-RPT & MTA-STS Checker

    Verify TLS reporting and MTA-STS policies for encrypted email transport. Checks DNS records, the policy file, mode, max_age and MX coverage.

    Check TLS-RPT and MTA-STS

    Try:

    What are TLS-RPT and MTA-STS?

    MTA-STS and TLS-RPT are two RFCs that together protect SMTP delivery from being downgraded to plaintext or man-in-the-middled. MTA-STS lets you publish a policy that says "mail for this domain must arrive over authenticated TLS to one of these MX hosts." TLS-RPT lets sending domains report any TLS failures back to you so you can detect attacks or misconfiguration.

    A typical setup looks like this:

    # _smtp._tls.example.com  (TLS-RPT)
v=TLSRPTv1; rua=mailto:tlsrpt@example.com

# _mta-sts.example.com  (MTA-STS TXT)
v=STSv1; id=20240601T120000Z

# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: mail.example.com
mx: *.mx.example.com
max_age: 604800

    What this checker validates

    • TXT record at _smtp._tls.<domain> starts with v=TLSRPTv1 and has valid rua endpoints
    • TXT record at _mta-sts.<domain> starts with v=STSv1 and has an id
    • Policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt is reachable over HTTPS (no redirects)
    • Policy declares a valid version, mode, mx list and max_age
    • Every published MX host matches at least one mx: pattern
    • max_age is at least one week (604800)

    TLS-RPT tag reference

    TagRequiredMeaning
    vYesVersion. Must be TLSRPTv1.
    ruaYesComma-separated list of mailto: and/or https:// report destinations.

    MTA-STS policy field reference

    FieldRequiredMeaning
    versionYesPolicy version. Must be STSv1.
    modeYesenforce, testing, or none.
    mxYes (one or more)MX hostname or wildcard pattern. Every receiving MX must match one.
    max_ageYesSeconds the policy can be cached by senders.

    How to fix common transport-security problems

    • Publish TLS-RPT before MTA-STS so you can see failures as soon as you start rolling out the policy
    • Serve the policy from https://mta-sts.<domain>/.well-known/mta-sts.txt with no redirects and Content-Type: text/plain
    • Start in mode: testing, watch reports for at least 2 weeks, then promote to enforce
    • List every MX host (or a wildcard that covers them) in the mx: entries — mismatches block delivery in enforce mode
    • Rotate the id= in the TXT record every time you change the policy file so senders fetch the new copy
    • Set max_age to at least 604800 (1 week); 1209600–2592000 is common in production

    Frequently asked questions

    Related free tools

    References

    Go beyond one-off checks

    Safer Sender continuously monitors your domain's DMARC, SPF and DKIM, classifies every sender, and guides you safely from p=none to p=reject.

    Start Free View pricing