MTA-STS Policy
MTA-STS (Mail Transfer Agent Strict Transport Security) enforces TLS encryption for emails sent to your domain, preventing SMTP downgrade attacks.
Want the result for your own site? Free DNS Security Checker — paste your domain, get the report.
Why It Matters
Without MTA-STS, email in transit can be intercepted through SMTP downgrade attacks where an attacker strips TLS from mail server connections. MTA-STS ensures encryption is mandatory.
How We Check
We verify the _mta-sts DNS TXT record exists with proper v=STSv1 format, then fetch and validate the policy file at https://mta-sts.{domain}/.well-known/mta-sts.txt.
How to Fix
Add a TXT record at _mta-sts.{domain}: 'v=STSv1; id=<unique_id>'. Host the policy file at mta-sts.{domain}/.well-known/mta-sts.txt with version, mode, mx entries, and max_age.
Frequently Asked Questions
What is MTA-STS Policy?
MTA-STS (Mail Transfer Agent Strict Transport Security) enforces TLS encryption for emails sent to your domain, preventing SMTP downgrade attacks.
Why does MTA-STS Policy matter for website security?
Without MTA-STS, email in transit can be intercepted through SMTP downgrade attacks where an attacker strips TLS from mail server connections. MTA-STS ensures encryption is mandatory.
How do I fix MTA-STS Policy issues?
Add a TXT record at _mta-sts.{domain}: 'v=STSv1; id=<unique_id>'. Host the policy file at mta-sts.{domain}/.well-known/mta-sts.txt with version, mode, mx entries, and max_age.
Related Security Checks
Related Tool
DNS Security Checker
Run all 6 related checks with our free dns security checker
Check Your Website Now
Run a free security scan to check for MTA-STS Policy issues and 62+ other security vulnerabilities.
Scan Your Website Free