Free domain tool
Read the _mta-sts DNS record, fetch the published policy file, and see whether the policy is actually enforced.
The _mta-sts TXT record only announces that a policy exists. The rules live in a separate policy file on the mta-sts subdomain, and a sending server applies nothing until it fetches that file. This checker fetches it, so it can report the real mode instead of assuming one.
For the combined view of every email signal, use the Email Security Check. To focus on a DMARC policy, use the DMARC Checker. To focus on SPF, use the SPF Record Checker. To check one known DKIM selector, use the DKIM Checker.
MTA-STS (SMTP MTA Strict Transport Security, RFC 8461) lets a domain publish a policy telling sending mail servers to require TLS when delivering to it. Without it, an attacker who can intercept the connection can strip encryption and the message is delivered in the clear.
It reads the _mta-sts TXT record for the domain, then fetches the policy file from the mta-sts subdomain over HTTPS and parses it. Both steps have to succeed before the mode is reported.
The TXT record only announces that a policy exists. The rules live in the policy file, and senders apply nothing until they fetch it. A domain with a TXT record whose policy file cannot be reached is announcing a protection nobody can apply.
In enforce mode a sender refuses to deliver if TLS cannot be negotiated as the policy requires. In testing mode the sender reports the failure but still delivers over an unprotected connection. In none mode the domain is explicitly telling senders to stop applying MTA-STS.
A domain with no MTA-STS has an improvement it has not made yet. A domain with a published but unusable policy looks protected while being no better off, so the gap between the belief and the reality is the risk.
max_age is how long senders cache the policy, in seconds. RFC 8461 allows up to 31557600 and recommends at least 604800 (one week). A very short max_age narrows the window in which a sender that cannot reach the policy file is still protected by it.
No. This checker only reads the public DNS record and fetches the publicly published policy file. It does not send email, does not modify DNS, and does not require access to your mail server.
It means the DNS lookup itself did not complete, so nothing can be said about the domain. No score is produced in that case — an unmeasured domain is never given a number, because a made-up score would be indistinguishable from a real one.