Truvo Free Tools

MTA-STS checker

MTA-STS tells sending mail servers that they must deliver to you over TLS with a valid certificate, and must not fall back to plaintext. This checker reads the record at _mta-sts.yourdomain.com, flags a missing policy, and names the SOC 2 and ISO 27001 controls the answer affects.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 CC7.2ISO 27001 A.5.14ISO 27001 A.8.20
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the MTA-STS checker works

The check is passive: it reads the public TXT record at _mta-sts.yourdomain.com through DNS over HTTPS and never connects to your mail servers.

01

Query

You enter a domain. The tool asks a public DNS over HTTPS resolver for the TXT record at _mta-sts. and looks for v=STSv1 and a policy id.

02

Read

A present record means sending servers will fetch your policy file from https://mta-sts./.well-known/mta-sts.txt and enforce TLS to the MX hosts it lists. A missing record is flagged: senders may still deliver to you in plaintext.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.7 and CC7.2, and ISO 27001:2022 A.5.14 (information transfer) and A.8.20. An enforcing policy is evidence that mail in transit to you cannot be downgraded.

Found a gap? We fix it for you.

Truvo's security engineers harden mail, DNS and TLS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • MTA-STS and TLSRPT

  • DMARC to reject

  • SPF and DKIM

  • Redundant MX hosts

  • Audit evidence

  • Fixed-price scope

MTA-STS checker: frequently asked questions

SMTP MTA Strict Transport Security, defined in RFC 8461, lets a receiving domain declare that mail sent to it must use TLS with a certificate that matches its MX hosts. Without it, SMTP TLS is opportunistic: an attacker on the path can strip the STARTTLS offer and the sender silently falls back to plaintext.

It reads the TXT record at _mta-sts.yourdomain.com and confirms it carries v=STSv1 and an id. It does not fetch or validate the HTTPS policy file, so a present record with a broken policy file will still show as present; test the file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt separately.

Both send with MTA-STS enforcement, and both publish guides for receiving domains. You still have to publish the DNS record and host the policy file for your own domain; the providers do not do that for you.

Yes. Publish the policy with mode: testing and a TLSRPT record so senders report failures without refusing delivery, confirm every MX host presents a valid certificate, then switch to mode: enforce. Enforce with a wrong MX list or an expired certificate means senders will hold your mail.

Truvo maps MTA-STS findings to SOC 2 CC6.1, CC6.7 and CC7.2, and to ISO 27001:2022 Annex A controls A.5.14 (information transfer) and A.8.20 (networks security). The mapping is advisory and is not a substitute for an audit.