Validates MTA-STS for secure email transmission
3 of 3 free audits left today
See what DNS Mail MTA-STS finds on your site. No sign-up needed.
Domain — takes the hostname of the audited URL and removes one leading www.. A URL with no hostname ends the audit with 501. The audited page itself is never fetched.
TXT record — looks up the TXT records at _mta-sts.<domain>. A resolver failure (SERVFAIL, timeout) ends the audit with 500; no record warns (300). Only the first record is read: it must start with v=STSv1 and carry an id= tag, otherwise it warns (301) and the policy is not fetched.
Policy fetch — requests https://mta-sts.<domain>/.well-known/mta-sts.txt the way a sending server does (RFC 8461 section 3.3): a valid certificate is required, no TLS fallback, and redirects are not followed. A connection, TLS or timeout error warns (305); any status other than 2xx, including a redirect, warns (304).
Mode — reads the mode: line of the policy. none fails (400), testing warns (302), a missing or unrecognised mode warns (303), enforce passes (200).
Aggregate — FAIL wins over WARNING; the first rule that stops the audit (no record, malformed record, fetch problem) is the one reported.
Specification pin — every run emits 37A-DnsMailMtaStsAuditor-100 (INFORMATION), naming RFC 8461 SMTP MTA Strict Transport Security (September 2018). It does not change the overall status.
Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-DnsMailMtaStsAuditor-100 | INFORMATION | Always. Records the specification this auditor implements: RFC 8461 SMTP MTA Strict Transport Security (September 2018). | — (recommendation is null; nothing for the site to change) | — |
37A-DnsMailMtaStsAuditor-300 | WARNING | No TXT record exists at _mta-sts.<domain>, so MTA-STS is not advertised. | Publish a TXT record at _mta-sts.{domain} with "v=STSv1; id=<timestamp>" (for example id=20260101000000Z) and serve the policy at {policyUrl}. | Without MTA-STS, a sending server that is downgraded to plaintext or pointed at an impostor mail server still delivers, so email to the domain can be read or altered in transit. |
37A-DnsMailMtaStsAuditor-301 | WARNING | The first TXT record does not start with v=STSv1 (case-insensitive) or has no id= tag. | Replace "{record}" at _mta-sts.{domain} with "v=STSv1; id=<timestamp>" (for example id=20260101000000Z) and change the id every time the policy changes. | Sending servers ignore an MTA-STS record they cannot parse, so the policy is never fetched and email to the domain gets no transport protection. |
37A-DnsMailMtaStsAuditor-305 | WARNING | Fetching the policy URL failed with a connection, TLS or timeout error. | Make {policyUrl} reachable over HTTPS with a certificate valid for mta-sts.{domain} (sending servers do not fall back, RFC 8461 section 3.3). Last error: {error}. | A policy host that cannot be reached over valid HTTPS gives sending servers nothing to enforce, so the advertised MTA-STS protection is not applied to email. |
37A-DnsMailMtaStsAuditor-304 | WARNING | The policy URL answered a status other than 2xx (a redirect counts: RFC 8461 section 3.3 forbids following it). | Serve the policy file at {policyUrl} with HTTP 200 directly (no redirect, RFC 8461 section 3.3) and a certificate valid for mta-sts.{domain}; it currently answers HTTP {status}. | When the policy cannot be fetched, sending servers that never cached it deliver without MTA-STS protection and those that cached it stop refreshing it. |
37A-DnsMailMtaStsAuditor-400 | FAIL | The policy says mode: none. | Change "mode: none" to "mode: enforce" (or "mode: testing" while validating) in {policyUrl} and bump the id in the _mta-sts.{domain} TXT record. | Mode none tells every sending server to drop the policy, so email to the domain can be downgraded to plaintext or sent to an impostor server without anyone noticing. |
37A-DnsMailMtaStsAuditor-302 | WARNING | The policy says mode: testing. | Once your TLS-RPT reports show no failures, change "mode: testing" to "mode: enforce" in {policyUrl} and bump the id in the _mta-sts.{domain} TXT record. | In testing mode a downgrade or certificate problem is only reported, never refused, so email to the domain can still be intercepted while the policy looks deployed. |
37A-DnsMailMtaStsAuditor-303 | WARNING | The policy has no mode line or a value other than enforce, testing or none. | Set "mode: enforce" in {policyUrl} (RFC 8461 allows enforce, testing or none, not "{mode}") and bump the id in the _mta-sts.{domain} TXT record. | Sending servers discard a policy whose mode they do not recognise, so the domain gets no transport protection despite advertising MTA-STS. |
37A-DnsMailMtaStsAuditor-200 | SUCCESS | The TXT record is valid and the policy fetched with HTTP 2xx says mode: enforce. Message names the policy URL and the record id. | — | — |
37A-DnsMailMtaStsAuditor-500 | ERROR | The resolver failed (SERVFAIL, timeout) on the _mta-sts.<domain> TXT lookup, so the record may well exist. | Check that the name servers answering for _mta-sts.{domain} respond to TXT queries, then run the audit again. Last error: {error}. | — |
37A-DnsMailMtaStsAuditor-501 | ERROR | The audited URL is empty, malformed or has no hostname, so no domain can be derived. | Monitor an absolute URL with a hostname (for example https://example.com/) instead of "{url}", then run the audit again. | — |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | MTA-STS is advertised and enforced | Valid _mta-sts TXT record and a policy fetched with HTTP 2xx whose mode is enforce (200). |
| WARNING | MTA-STS is missing, unreadable or not enforcing | No TXT record (300); malformed record (301); policy in testing mode (302); unknown or missing mode (303); policy URL not 2xx (304); policy fetch failed (305). |
| FAIL | MTA-STS is switched off by the policy | Policy mode none (400). |
| ERROR | The auditor could not run the check | DNS lookup failure (500); URL without a hostname (501). |
| INFORMATION | Specification pin | Always emitted (100); does not change overall status. |
Every check carries the audited URL as its resource and, in data, the fields relevant to that step: domain, mtaStsFqdn, txtRecords, mtaStsRecord, policyId, policyUrl, policyHttpStatus, policyMode, policyBody (capped at 2 KB) and policyFetchError.
Without it, an attacker on the network path can tell a sending server that your mail servers do not support TLS, or present any certificate, and the message is delivered in the clear.
MTA-STS works with DANE and TLS-RPT: TLS-RPT (_smtp._tls.<domain>) is how you learn about delivery failures before switching from testing to enforce.
enforce is the only mode that protects email; testing only reports problems, and none tells senders to forget the policy (used to retire it).
Every change to the policy file needs a new id in the TXT record, otherwise sending servers keep the cached version until max_age expires.
The policy must be served at https://mta-sts.<domain>/.well-known/mta-sts.txt with a certificate valid for mta-sts.<domain>; RFC 8461 forbids following redirects and falling back to HTTP, and this auditor does neither.
The auditor reads only the mode line. mx entries and max_age are not validated against the domain's MX records.
A URL with no hostname used to FAIL; it is now ERROR (501), because the problem is with the monitored URL, not the domain.
A DNS resolver failure used to be reported as "MTA-STS not advertised" (WARNING); it is now ERROR (500), because the record may exist.
A TXT record that starts with v=STSv1 but has no id= tag used to be accepted; it is now malformed (301).
The policy body stored in check data is capped at 2 KB.
All other verdicts are unchanged: mode: none stays FAIL; testing, an unknown mode, a non-2xx policy answer and a policy fetch error stay WARNING.
Only the first _mta-sts TXT record is read; RFC 8461 says there must be exactly one.
The policy's mx patterns, max_age and the actual TLS configuration of the mail servers are out of scope (see the DNS Mail MX and TLS-RPT auditors).
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.