# MTA-STS and TLS-RPT Validator

Check MTA-STS DNS records, HTTPS policy, MX coverage and TLS-RPT publication. Does not test SMTP TLS connections or MX certificates.

Canonical: https://tamperbox.dev/mta-sts-checker

Reviewed: 2026-10-13

## Capabilities and processing

Enter a domain or paste a policy file. For a domain, our server reads the _mta-sts and _smtp._tls records and the MX records, and fetches the policy from `https://mta-sts.<domain>/.well-known/mta-sts.txt`. A pasted policy is read in your browser.

The chain shows each step a sending server checks, the MX table shows which policy line covers each server, and a suggested policy in enforce mode covers every MX host.

## Example workflow

harbor-supply.example is in testing mode and its backup MX server is missing from the policy. Copy the suggested policy, serve it over HTTPS, then change the id in the record.

## Limits and interpretation

Senders cache a policy for max_age seconds, so changes take effect slowly. A wildcard mx line covers one label only. The certificate of each MX server is not tested here. The application does not persist tool inputs or results.

## Related tools

[Email Domain Checker](https://tamperbox.dev/email-domain) explains MX routing. [Email Provider Lookup](https://tamperbox.dev/email-provider) identifies known hosts and gateways from MX records.

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)

## References

[SMTP MTA Strict Transport Security: RFC 8461](https://www.rfc-editor.org/rfc/rfc8461).