MTA-STS record checker

MTA-STS tells sending mail servers to only deliver to your domain over TLS, blocking downgrade attacks. It needs a DNS record AND a policy file served over HTTPS.

Example result for example.com

Sample data. Run the check above to see yours.

MTA-STS in testing mode

Needs a fix

A policy is published in mode: testing. TLS failures are reported, not enforced.

_mta-sts.example.com TXT

v=STSv1; id=20261001T000000

Policy file served over HTTPS at mta-sts.example.com.
Switch to mode: enforce once TLS-RPT reports show no failures.

Want ongoing monitoring?

This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.

Start free monitoring