MTA-STS and TLS-RPT check

Looks up _mta-sts, fetches the policy from https://mta-sts.<domain>/.well-known/mta-sts.txt with certificate verification and no redirects, parses mode, mx and max_age, compares the domain's MX hosts with the policy and validates the TLS-RPT record.

Updated 2026-10-25

What this tool checks

MTA-STS has two parts, and the check reads both.

The DNS record. It looks up the TXT record at _mta-sts.DOMAIN. There must be exactly one record that starts with v=STSv1, and it must carry an id of 1 to 32 letters and digits. Senders use the id to notice that the policy changed.
The policy file. It fetches https://mta-sts.DOMAIN/.well-known/mta-sts.txt and parses version, mode (enforce, testing or none), the mx patterns and max_age.

It then looks up the domain's MX records and compares each host with the mx patterns of the policy. A host that no pattern matches would fail delivery under enforce.

Finally it reads the TLS-RPT record at _smtp._tls.DOMAIN, which must start with v=TLSRPTv1 and give at least one rua address with mailto: or https:.

How the policy is fetched

The fetch behaves as RFC 8461 requires a sender to behave. The certificate is verified against mta-sts.DOMAIN, redirects are never followed, only status 200 with text/plain is accepted, and the file may be at most 64 KB. The check only connects to addresses of mta-sts.DOMAIN that are public unicast addresses. If the file cannot be fetched, that is reported as a finding with the reason in the evidence, and the rest of the result is still returned.

How to read the result

No record (MTASTS_NOT_FOUND) is information: the domain has not opted in.
An unreachable or invalid policy is an error, because senders then treat the domain as having no policy at all.
An MX host outside the policy is an error under enforce (MTASTS_MX_NOT_COVERED) and a warning under testing.
A max_age below one day is a warning (MTASTS_LOW_MAX_AGE). Senders cache the policy for that long, and a short value gives little protection between visits.

The MTA-STS and TLS-RPT guide explains the protocol and a safe rollout.

Limitations

The check does not connect to your mail servers on port 25, so it does not test whether they offer STARTTLS or which certificate they present.
It reads the policy as served at the time of the check. Senders that cached an older policy keep using it until its max_age runs out.
TLS-RPT reports themselves are not read; the check only validates the record that asks for them.

Use it from code

API reference for MTA-STS and TLS-RPT check

curl -i "https://api.probekit.dev/v1/mail/mta-sts?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.02 per check

Findings this tool can report

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (2)

Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

MTA-STS (10)

Error MTASTS_INVALID_POLICY The MTA-STS policy file is not valid.
Error MTASTS_INVALID_RECORD The MTA-STS record has invalid syntax.
Warning MTASTS_LOW_MAX_AGE The MTA-STS policy has a max_age below one day.
Info MTASTS_MODE_NONE The MTA-STS policy is in mode none.
Warning MTASTS_MODE_TESTING The MTA-STS policy is in testing mode.
Error MTASTS_MULTIPLE_RECORDS More than one MTA-STS record is published.
Error MTASTS_MX_NOT_COVERED An MX host is not covered by the enforced MTA-STS policy.
Warning MTASTS_MX_NOT_COVERED_TESTING An MX host is not covered by the MTA-STS policy in testing mode.
Info MTASTS_NOT_FOUND The domain publishes no MTA-STS record.
Error MTASTS_POLICY_UNAVAILABLE The MTA-STS policy file could not be fetched.

TLS-RPT (2)

Warning TLSRPT_INVALID The TLS-RPT record is not valid.
Info TLSRPT_NOT_FOUND The domain publishes no TLS-RPT record.

Frequently asked questions

What is the difference between MTA-STS and TLS-RPT?

MTA-STS (RFC 8461) lets a domain tell sending servers that its mail servers support TLS with a valid certificate, and that delivery should fail instead of falling back to plain text. TLS-RPT (RFC 8460) asks senders to send daily reports about TLS problems they met while delivering to the domain. They are independent, but TLS-RPT is how you find out whether an MTA-STS policy causes trouble.

Why does the check report that the policy cannot be fetched?

The policy file must be served at https://mta-sts.DOMAIN/.well-known/mta-sts.txt with a certificate that is valid for that host name, status 200 and the content type text/plain. A redirect, a certificate for another name, an HTML error page or a missing host all make senders ignore the policy. The evidence of MTASTS_POLICY_UNAVAILABLE names the reason.

Should I start in testing mode?

Yes, that is what mode: testing is for. Senders that support MTA-STS then report failures through TLS-RPT but still deliver. Once the reports show that all your MX hosts pass, you can move to mode: enforce. The check reports testing mode as a warning so it is not forgotten.

Does a wildcard in the policy cover my MX hosts?

A pattern such as *.example.net matches exactly one extra label, so it covers mx1.example.net but not example.net itself or a.b.example.net. The check compares every MX host of the domain against the patterns and lists the ones that are not covered.