Email Authentication
MTA-STS check
MTA-STS tells other mail servers they must use encryption when delivering to you, closing off downgrade and interception attacks.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
We look for the _mta-sts TXT record, fetch the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt and read its mode. Enforce and testing pass, mode: none is noted as switched off, and a record whose policy file does not load (senders follow no redirects) or lacks a required line (version, mx, max_age) is a warning. No policy at all is a warning on a domain that receives mail.
Why it matters to your business
Email between servers is only encrypted if both sides agree to it, and an attacker in the middle can quietly strip that agreement. MTA-STS makes encryption mandatory for mail sent to you, which matters most for businesses that receive contracts, health or financial information by email.
How to fix it
- Publish a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt listing your MX hosts, starting with mode: testing.
- Add a TXT record at _mta-sts.yourdomain: v=STSv1; id=20260101.
- Add TLS-RPT so you hear about failures, then move the policy to mode: enforce.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.