MTA-STS Tester & Policy Validator

What is MTA-STS?

MTA-STS (SMTP MTA Strict Transport Security) is an email security standard, defined in RFC 8461, that lets a domain require inbound mail be delivered over authenticated TLS. It closes the gap where opportunistic STARTTLS can be stripped by an attacker, forcing senders to use encryption with a valid certificate or refuse to deliver.

How does MTA-STS work?

MTA-STS combines a DNS TXT record with an HTTPS-hosted policy file. The TXT record signals that a policy exists, and the policy file states the rules a sending server must follow before delivering mail.

1. TXT discovery record - _mta-sts.<domain> publishes v=STSv1 and a policy id that changes whenever the policy changes.
2. Policy fetch - sending servers retrieve https://mta-sts.<domain>/.well-known/mta-sts.txt over HTTPS with a valid certificate.
3. Mode enforcement - the policy mode is enforce, testing, or none.
4. MX matching - each mx line lists the hostnames (wildcards allowed) authorised to receive mail.
5. Caching - max_age tells senders how long to cache the policy, commonly one week (604800 seconds).

What does MTA-STS mode mean?

The mode controls how strictly senders enforce the policy. There are exactly three values defined by RFC 8461.

• enforce - mail is delivered only over validated TLS; otherwise it is not delivered. This is the protective end state.
• testing - TLS problems are reported via TLS-RPT but mail is still delivered. Use this while you confirm reports are clean.
• none - the policy is effectively disabled, typically used to phase MTA-STS out.

Why does the policy need to be served over HTTPS without redirects?

RFC 8461 requires the policy file be returned directly with an HTTP 200 over HTTPS using a certificate valid for mta-sts.<domain>. Redirects are not allowed because they would let an attacker who controls the network point senders at a forged policy. This tester fetches the policy with redirects disabled to mirror that requirement.