MTA-STS Policy
MTA-STS (Mail Transfer Agent Strict Transport Security) enforces TLS encryption for emails sent to your domain, preventing SMTP downgrade attacks.
Why It Matters
Without MTA-STS, email in transit can be intercepted through SMTP downgrade attacks where an attacker strips TLS from mail server connections. MTA-STS ensures encryption is mandatory.
How We Check
We verify the _mta-sts DNS TXT record exists with proper v=STSv1 format, then fetch and validate the policy file at https://mta-sts.{domain}/.well-known/mta-sts.txt.
How to Fix
Add a TXT record at _mta-sts.{domain}: 'v=STSv1; id=<unique_id>'. Host the policy file at mta-sts.{domain}/.well-known/mta-sts.txt with version, mode, mx entries, and max_age.
Related Security Checks
Related Tool
DNS Security Checker
Run all 6 related checks with our free dns security checker
Check Your Website Now
Run a free security scan to check for MTA-STS Policy issues and 58+ other security vulnerabilities.
Scan Your Website Free