X-RAY // MAIL // MTA-STS

MTA-STS
CHECK.

Check the _mta-sts record and the policy at mta-sts.<domain>/.well-known/mta-sts.txt: testing or enforce mode, max_age and the allowed MX.

Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.

MTA-STS

WAITING

Enter a domain above to run this check.

01 // WHAT THE CHECK VERIFIES

What the check verifies

Checks the _mta-sts record and the policy published at https://mta-sts.<domain>/.well-known/mta-sts.txt.

02 // WHY IT MATTERS

Why it matters

MTA-STS makes sending servers use valid TLS for delivery, so nobody on the path can downgrade the connection to plain text.

03 // HOW TO READ THE RESULT

What each result means

OK: A valid policy in mode: enforce, served over HTTPS.
WARNING: The _mta-sts record exists, but the policy over HTTPS could not be validated.
INFO: No MTA-STS (optional), or a policy in testing or none.

ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.

04 // HOW TO FIX

How to fix

Publish the TXT and the policy, served over HTTPS with a valid certificate for mta-sts.<domain> and no redirect. Start in testing and change the id on every update:

_mta-sts.example.com. TXT "v=STSv1; id=20261015"

# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: mx1.example.com
max_age: 604800

Would rather have someone else do it? Bit Happens can fix this →

05 // CONTINUE

More checks in Email

Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →