Check the whole MTA-STS chain: record, policy file, every MX server, and TLS-RPT reports.
Example
The chain
MX coverage
| MX host | Priority | Matched by | Status |
|---|
Suggested policy file
Findings
Capabilities and processing
Enter a domain or paste a policy file. For a domain, our server reads the _mta-sts and _smtp._tls records and the MX records, and fetches the policy from https://mta-sts.<domain>/.well-known/mta-sts.txt. A pasted policy is read in your browser.
The chain shows each step a sending server checks, the MX table shows which policy line covers each server, and a suggested policy in enforce mode covers every MX host.
Example workflow
harbor-supply.example is in testing mode and its backup MX server is missing from the policy. Copy the suggested policy, serve it over HTTPS, then change the id in the record.
Limits and interpretation
Senders cache a policy for max_age seconds, so changes take effect slowly. A wildcard mx line covers one label only. The certificate of each MX server is not tested here. The application does not persist tool inputs or results.
Related tools
Email Domain Checker explains MX routing. Email Provider Lookup identifies known hosts and gateways from MX records.