Email security

MTA-STS enforces encrypted delivery

SPF, DMARC, DKIM, MTA-STS: protection against spoofed mail in your name.

Why it matters

Mail to you can be downgraded to unencrypted delivery by an attacker in the network path, exposing its contents.

How to fix it

Moderate · a few hours

Host a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt.
Publish the _mta-sts TXT record.
Start in testing mode, switch to enforce after checking TLS-RPT reports.

mta-sts.txt

version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

DNS TXT

_mta-sts.example.com.  TXT  "v=STSv1; id=20260101"

Test this now, free: SPF, DMARC & DKIM checker - no sign-up.

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free