MTA-STS Check
MTA-STS lets a domain tell sending servers to require an encrypted, authenticated TLS connection when delivering to its MX hosts. This check validates both parts, the _mta-sts TXT record and the HTTPS policy file, and compares the policy with your real MX records.
When to use this: You are enabling MTA-STS, changed mail providers, or receive TLS failure reports. Command prefix mta-sts:
About the MTA-STS Check
Validate MTA-STS: the _mta-sts TXT record and the HTTPS policy file that tells senders to require TLS when delivering to your MX hosts.
FAQ
- Where does the policy file live?
- At https://mta-sts.yourdomain/.well-known/mta-sts.txt, served with a valid certificate.
- Testing or enforce?
- Run mode: testing with TLS-RPT reports first, then switch to enforce once reports are clean.