Skip to content

MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade. A DNS advertisement alone is not enough. This checker reads the _mta-sts TXT, fetches the HTTPS policy file, and checks mode, MX coverage, and id= consistency against the hosts we actually found.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. A private assessment (see the checkbox in the scan dialog) is the only difference.

1.36%
of mail-enabled Top-1M domains advertise MTA-STS in DNS
0.62%
serve an enforce-mode policy

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
SPF checker

SPF lists which hosts may send mail as your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

What does an MTA-STS check cover?

Two pieces: a TXT record at _mta-sts.example.com, and a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt. SecLens.ONE fetches that file without following redirects, then checks syntax, mode, max_age, and whether mx: lines cover the live MX hosts.

Why is mode testing not enough?

testing asks senders to report failures but still deliver on a downgrade. enforce is the policy that actually refuses a stripped TLS session. Testing is a rollout step. It is not transport protection.

Why do so few domains pass?

The October 2026 Top-1M study found 1.36% advertise MTA-STS and 0.62% enforce. July 2026 was 1.40% and 0.64%. Common failures are a DNS record pointing at an HTTPS host that does not serve the file, testing left on, and mx: patterns that miss a live MX.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.