MTA-STS checker: the two records that stop mail to you being downgraded.
MTA-STS requires inbound mail to arrive over TLS instead of leaving it to opportunistic encryption that fails silently. TLS-RPT is how you find out when that goes wrong. They are checked together because publishing one without the other is half a control.
SMTP encryption is optional, and failing back is silent.
By default, a sending server offers TLS and accepts a refusal. An attacker positioned between the two can strip that offer, and the message is delivered in the clear with nobody notified — not the sender, not you. MTA-STS is the published statement that says refuse to deliver instead of downgrading.
That is also why the policy starts in testing mode. In testing, failures are reported but mail still flows; in enforce, a mismatch between your policy and your real MX hosts means mail to you stops. Move to enforce once TLS-RPT has been quiet for a few weeks, not before.
Frequently asked questions.
Yes. Publishing the _mta-sts DNS record is only half the setup — the policy file itself must be served over HTTPS at a fixed address, with a certificate kept valid indefinitely. Managed hosting on the Growth plan and above serves that file and handles the certificate.
No. It fetches your published policy file through the DDMARC API and reports what it contains, including the mode and the mx hostnames listed. It does not connect to your mail servers, test a live STARTTLS negotiation, or compare the listed mx hostnames against your domain's live MX records.
max_age sets how long, in seconds, a sending server may cache your policy before re-fetching it. RFC 8461 allows values up to 31,557,600 seconds (about one year); a shorter value during testing lets you roll back faster if something is misconfigured.
In testing mode, a sending server reports failures through TLS-RPT but still delivers mail even if TLS cannot be verified. In enforce mode, a sending server refuses to deliver mail it cannot verify against your policy. Move to enforce only once TLS-RPT reports have been quiet for a period of monitoring.
For the full walkthrough, see the MTA-STS setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
Transport is the half of the job DMARC does not cover.
Hosting an MTA-STS policy means running an HTTPS endpoint with a certificate somebody has to renew, indefinitely. The failure is quiet — nobody notices an expired certificate until transport security stops being enforced. From Growth, DDMARC serves the policy file and handles the certificates; every paid plan watches the policy for fetch failures and drift.