Transport encryption
Check MTA-STS
Check the TXT record, safely retrieved HTTPS policy and MX coverage.
Enter only the domain, such as example.com – without https://, a path or an email address.
A new check is available every 5 minutes per tool and domain. Until then, you see the saved result.
What the tool accesses
DNS and IP-pinned HTTPS on port 443.
How the check works
What exactly is checked?
- Find the TXT record under _mta-sts and check the version and policy ID.
- Resolve the mta-sts host to public IP addresses only and pin the selected address for HTTPS.
- Retrieve exactly /.well-known/mta-sts.txt with size, time and Content-Type limits.
- Evaluate HTTP status, absence of redirects, policy syntax, mode, max_age and coverage of all MX targets.
Assessment
How is the result determined?
RFC 8461 requires an immediate HTTP 200 response at the standard policy URL. A 301/302 redirect is not followed as a valid policy; its Location target is shown for diagnosis.
- Checker
1.0.0- What the tool accesses
- DNS and IP-pinned HTTPS on port 443
- Technical standards and sources
- RFC 8461
A technical snapshot, not a certificate or a delivery guarantee. Methodology public-tools-v1. Reviewed on 20.08.2026.