DMARCbis Explained: What’s Changing + What Domain Owners Need to Know (Q&A with DMARCbis Co-Editor) View here

MTA-STS record checker tool

Use Sendmarc’s MTA-STS record checker to confirm that your Mail Transfer Agent Strict Transport Security (MTA-STS) record is correctly set up. This tool helps ensure your domain’s emails are protected from interception, tampering, and downgrade attacks.

To get started, enter your organization’s domain in the field below and click Lookup.

What is an MTA-STS record checker?

An MTA-STS record checker is a specialized tool that helps domain owners verify the presence, correctness, and functionality of their MTA-STS records.

Key functions of an MTA-STS checker:

Check the DNS TXT record at _mta-sts.yourdomain.com
Validate the structure and content of the record
Confirm that the policy version and id are correct

Your business can also check its domain’s vulnerability with our Know Your Score tool.

Why does MTA-STS matter?

MTA-STS is an email security protocol that enforces encrypted transmission between sending and receiving email servers. It protects email traffic from Man-in-the-Middle (MitM) and downgrade attacks.

Without MTA-STS, cybercriminals can intercept messages or downgrade connections to bypass encryption, putting sensitive information at risk. MTA-STS can ensure that emails are only delivered over encrypted channels, which strengthens trust, improves deliverability, and helps companies comply with modern security standards.

Why your organization should use an MTA-STS record checker

Implementing and regularly validating a record is critical for multiple reasons:

Prevents email interception: With the correct policy, MTA-STS enforces the encrypted delivery of all emails, reducing the risk of message interception during transit.
Blocks downgrade attacks: When set to enforce mode, MTA-STS ensures that email is always transmitted using Transport Layer Security (TLS). This blocks threat actors from forcing a fallback to unencrypted or less secure connections.
Improves deliverability: Email servers often prefer secure connections. Proper MTA-STS configuration reduces the risk of email rejection or classification as Junk or Spam.
Simplifies troubleshooting: Identifies misconfigurations quickly, allowing for faster resolution of email delivery and security issues.
Supports compliance and trust: Shows commitment to modern email security standards, enhancing regulatory compliance and building customer trust.

Interested in checking your business’s record?

Test a record

How to verify with an MTA-STS record checker

Follow these steps to validate your company’s MTA-STS configuration using Sendmarc’s MTA-STS validator.

Step-by-step process:

1. Enter the domain

Input the domain into the record checker.

2. Automated DNS and policy analysis

The tool checks for the required DNS TXT record at _mta-sts.yourdomain.com and fetches the record.

3. Validation results

The checker confirms that the TXT record exists and is correctly formatted (it must begin with v=STSv1 and include an id).

4. Review and resolve issues

If the checker identifies issues, users should review their records to understand what’s misconfigured and update accordingly.

Quick summary:

Enter the domain
Assess the checker’s findings
Identify and correct configuration errors

Missing or incorrect record? Use an MTA-STS record checker

If your organization’s record is missing or misconfigured, it might be vulnerable to email interception, MitM attacks, and failed deliveries. Below are common issues and how to solve them.

Missing DNS TXT record

Add a TXT record at _mta-sts.yourdomain.com using the following format:

Host	Type	Value
_mta-sts.yourdomain.com	TXT	v=STSv1; id=ID;

Always update the id field when the policy file changes.

Policy file not found or invalid

Ensure the policy file includes the following:

version: STSv1
mode: enforce/testing/none
mx: mail.yourdomain.com
max_age: 604 800

Adjust the mode and mx values based on your business’s infrastructure.

Outdated or mismatched records

Update the id in your company’s DNS TXT record each time the policy file is modified. This requests that sending servers fetch the updated version.

Ready to secure your domain?

Use Sendmarc’s MTA-STS record checker to ensure you’re protected against email interception and modification.

Validate record

Start a free trial

Sign up for a free trial of Sendmarc’s advanced email authentication platform to take full control of your email security. Defend against spoofing, phishing, and other email-based threats.

Protect your emails. Build trust. Improve deliverability.

Start now

MTA-STS record checker FAQs

What is an MTA-STS record?

An MTA-STS record is a DNS TXT record that shows that a domain supports Mail Transfer Agent Strict Transport Security (MTA-STS). This record instructs external email servers to fetch and enforce the domain’s email security policy.

What does a valid MTA-STS record look like?

A valid MTA-STS record is a TXT record located at _mta-sts.yourdomain.com and should follow this format:

Host	Type	Value
_mta-sts.yourdomain.com	TXT	v=STSv1; id=ID;

The record must begin with v=STSv1 and include an id value to signal updates to the policy file.

What happens if my MTA-STS record is incorrect?

If an MTA-STS record is missing or incorrect, encryption might not be enforced on your organization’s emails. This exposes it to risks such as message interception and manipulation.

How do I fix an MTA-STS misconfiguration?

To fix an MTA-STS misconfiguration, check the DNS TXT record to ensure it follows the correct format, update the id whenever the policy changes, and host a valid policy file. Use Sendmarc’s MTA-STS checker to validate the configuration after making changes.

How does MTA-STS affect my email deliverability?

Proper implementation of MTA-STS improves email deliverability by increasing receiving email servers’ trust, reducing the chance of message rejection and Spam/Junk filtering.

Can I have multiple MTA-STS records?

No, a domain can only have one MTA-STS TXT record. Multiple records can cause validation failures and prevent proper enforcement of the email security policy.

Do I need MTA-STS if I already have TLS-RPT?

Yes, MTA-STS is still necessary even if your business has Transport Layer Security Reporting (TLS-RPT) enabled. While TLS-RPT provides reporting on delivery and encryption issues, MTA-STS actively enforces encrypted delivery. These protocols are complementary and should be used together for effective email security.