MTA-STS Checker
Whether inbound mail transport is required to use authenticated TLS.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: RFC 8461 — SMTP MTA Strict Transport Security (MTA-STS)
About this validation
Checks whether inbound mail transport is required to use authenticated TLS.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live DNS TXT-record and HTTPS policy-file lookup performed by SEOTechTests. Standard: RFC 8461 defines the MTA-STS DNS record and policy-file mechanism.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What does MTA-STS protect against?
It lets a domain require that other mail servers only deliver to it over authenticated TLS, closing a gap where SMTP's opt-in encryption could otherwise be silently downgraded to plaintext by a network attacker.
Why check both a DNS record and a policy file?
MTA-STS requires both: a DNS TXT record announcing that a policy exists, and an HTTPS-served policy file with the actual enforcement mode -- both are checked because either being missing means MTA-STS isn't actually enforced.
Is MTA-STS required for a domain to be considered secure?
No. It specifically hardens inbound SMTP transport encryption -- most domains, including many well-run ones, don't configure it, and its absence doesn't mean mail delivered to the domain is being intercepted.
Why is this included in Domain Security Score's DNS Security group?
It's a standardized, DNS-published mail-transport protection alongside SPF/DKIM/DMARC, so it fits the same group even though it protects a different part of the mail flow (transport encryption rather than sender authentication).