[ Free tool · Email Authentication ]
MTA-STS & TLS-RPT Checker
Check your TLS policy record, policy file and TLS reporting.
[ About this tool ]
This MTA-STS and TLS-RPT checker validates the _mta-sts record, fetches the policy file, checks mode and MX coverage, and confirms the TLS-RPT reporting record.
How to read the results
- ›mode: enforce gives full protection; testing only reports.
- ›Every MX host must match an mx: line in the policy.
- ›Some policy files block browser requests (CORS); that is reported, not a failure.
Frequently asked questions
How do I check MTA-STS?
Enter your domain. The tool checks the TXT record, the HTTPS policy file and the TLS-RPT record.
What is the difference between MTA-STS and TLS-RPT?
MTA-STS enforces encrypted delivery; TLS-RPT reports when encrypted delivery fails.
Learn more in our guide: What is MTA-STS? Setup Guide, Record and Policy File
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More tools ]
DANE / TLSA Checker
Check DNSSEC-signed TLSA records that lock down SMTP TLS.
Full Domain Health Scan
Run every email security check at once and get one score.
DMARC Checker
Look up and explain any domain's live DMARC record.
SPF Checker
Validate your SPF record and check the 10-lookup limit.
DKIM Lookup
Verify a DKIM selector is published and the key is valid.
BIMI Record Checker
Check a BIMI record and whether the logo will actually display.