Pro move: type dmarc:yourdomain.com or blacklist:1.2.3.4 straight into the box — it switches tools for you.
About this tool. MTA-STS tells sending servers they must use verified TLS when delivering to you, blocking downgrade and man-in-the-middle attacks. It needs both a DNS record and a policy file — this check validates the pair together.
How to read your mta-sts checker results
MTA-STS tells other servers to require TLS encryption when delivering mail to you, and not to fall back to plaintext.
It needs a TXT record at _mta-sts.yourdomain and a policy file served over HTTPS at mta-sts.yourdomain.
Common problems and how to fix them
MTA-STS record present but not enforced
Confirm the HTTPS policy file exists at the mta-sts subdomain and lists the correct MX hosts, with mode set to enforce.
Common questions.What is MTA-STS?
A standard that lets a domain require encrypted (TLS) delivery of inbound mail, closing a gap where attackers could force plaintext.
Is MTA-STS required?
No, but it hardens inbound mail against downgrade attacks. Pair it with TLS-RPT to get reports when encryption fails.