Menu
Features
Cold email infrastructureDomains and mailboxesWarm-upProspect findingEmail writingBounce and spam protectionReply inbox24/7 monitoring
Guides
Cold email guideWhat cold email costsCold email domainsHow many mailboxes you needCold email warm-upHow to warm up a domainCold email deliverabilityWhy cold emails go to spamHow to write a cold emailCold email templatesCold email softwareSmartlead vs InstantlyAll cold email guides
Free tools
Domain checkerDeliverability testBlacklist checkerAI cold email generatorCold email checkerEmail header analyzerSubject line testerEmail spam checkerEmail verifierSending domain generatorEmail permutatorSPF record generatorDMARC record generatorDKIM record generator
Pipefire
PricingDeliverabilityUse cases
Sign inStart setup

MTA-STS checker: test your MTA-STS policy and TLS-RPT

Type a domain and check its MTA-STS setup: the TXT record at _mta-sts, the policy file it points to, whether the policy lists every mail server the domain uses, its mode, and TLS-RPT reports. Free, no sign-up, nothing stored.

What is MTA-STS, and does cold email need it?

MTA-STS tells other mail servers that email coming in to your domain must travel encrypted, and to which servers. It protects mail you RECEIVE, such as replies to your cold email, from being read or redirected in transit. It does not change where your outgoing cold email lands, so it is optional for a sending domain. It is worth setting up on your main business domain.

What does this MTA-STS checker test?

  • The record: one TXT record at _mta-sts.yourdomain.com such as v=STSv1; id=20261007.
  • The policy file: served at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with a valid certificate.
  • Coverage: every MX host the domain uses must match an mx: line. In enforce mode, an unlisted server means senders refuse to deliver.
  • Mode and TLS-RPT: testing only reports; enforce protects. TLS-RPT sends you a daily report of failures.

What should an MTA-STS policy file contain for Google Workspace?

For a domain on Google Workspace set up since 2023, the policy lists smtp.google.com; older setups use the aspmx.l.google.com family, which mx: *.aspmx.l.google.com plus mx: aspmx.l.google.com cover. Start with mode: testing and max_age: 86400, read a week of TLS-RPT reports, then switch to enforce and raise max_age. Check the MX records first with the MX lookup.

Why does my MTA-STS policy fail to load?

The policy host needs its own DNS record and an HTTPS certificate valid for mta-sts.yourdomain.com, and the file must be served directly, without a redirect. Senders that see the TXT record but cannot fetch the file fall back to unprotected delivery, so a broken policy gives no protection. Change the id in the TXT record every time you edit the file, or senders keep the old one until it expires.