MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade. A DNS advertisement alone is not enough. This checker reads the _mta-sts TXT, fetches the HTTPS policy file, and checks mode, MX coverage, and id= consistency against the hosts we actually found.
Public assessments are free. No account. The full 0–100 stack is included below the focused result.
Figures from the July 2026 Top-1M study.
Two pieces: a TXT record at _mta-sts.example.com, and a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt. SecLens fetches that file without following redirects, then checks syntax, mode, max_age, and whether mx: lines cover the live MX hosts.
testing asks senders to report failures but still deliver on a downgrade. enforce is the policy that actually refuses a stripped TLS session. Testing is a rollout step. It is not transport protection.
The July 2026 Top-1M study found 1.40% advertise MTA-STS and 0.64% enforce. Common failures are a DNS record pointing at an HTTPS host that does not serve the file, testing left on, and mx: patterns that miss a live MX.
Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.