Email Security
MTA-STS & TLS-RPT Policy Validator
Validate Mail Transfer Agent Strict Transport Security (MTA-STS, RFC 8461) and SMTP TLS Reporting (TLS-RPT, RFC 8460). MTA-STS prevents downgrade and Man-in-the-Middle (MITM) attacks on SMTP connections by declaring that inbound MX servers require valid TLS encryption. Inspect DNS TXT records, verify the HTTPS mta-sts.txt policy file, check wildcard MX coverage, and audit TLS-RPT aggregate reporting configurations.
Key Capabilities & Features
dnsfyi combines high-speed global Anycast DNS queries with comprehensive security auditing into a unified diagnostic suite.
- • MTA-STS DNS TXT record validation (_mta-sts.<domain>)
- • HTTPS policy file inspection (https://mta-sts.<domain>/.well-known/mta-sts.txt)
- • Mode verification: enforce, testing, or none with max_age validation
- • Wildcard and exact MX host coverage matching
- • TLS-RPT DNS record verification (_smtp._tls.<domain>)
- • Detailed RFC 8461 & RFC 8460 remediation blueprints
How to Use This Tool
To audit any domain or IP address, enter the hostname into the search box to run an instant parallel multi-resolver inspection.
- Enter your domain name (e.g. example.com) into the search bar.
- Review the MTA-STS DNS record status (_mta-sts.example.com).
- Inspect the policy file mode, max-age, and MX host rules fetched over HTTPS.
- Check the MX coverage table to ensure all mail exchange servers are covered.
- Verify the TLS-RPT record for automated failure telemetry delivery.
Common Use Cases
dnsfyi is primarily used to troubleshoot email deliverability failures, verify global DNS propagation, and audit SSL certificate health.
- → Upgrading email infrastructure from opportunistic STARTTLS to enforced TLS.
- → Meeting Google and Yahoo 2024 bulk sender security compliance requirements.
- → Detecting TLS-stripping and MITM interception risks on incoming mail routes.
- → Auditing third-party email security posture before vendor onboarding.
Frequently Asked Questions
Find direct answers about dnsfyi's multi-resolver query engine, privacy policy, domain security checks, and free REST API.
- What is MTA-STS (RFC 8461)?
- MTA-STS (Mail Transfer Agent Strict Transport Security) is an Internet standard specified in RFC 8461. It allows domain owners to declare that their mail servers (MX) require TLS encryption for all incoming SMTP connections, preventing Man-in-the-Middle (MITM) and TLS-stripping downgrade attacks.
- How does MTA-STS differ from opportunistic STARTTLS?
- Standard SMTP uses opportunistic STARTTLS: if an active network attacker intercepts the handshake and strips the STARTTLS command, the sending server downgrades to unencrypted cleartext. MTA-STS mandates TLS and refuses delivery if a valid TLS session cannot be established.
- What is TLS-RPT (RFC 8460)?
- TLS-RPT (SMTP TLS Reporting, RFC 8460) works alongside MTA-STS and DANE. It enables domain owners to receive automated daily JSON aggregate reports from sending mail servers detailing successful deliveries and TLS handshake failures.
- What are the technical requirements to enable MTA-STS?
- MTA-STS requires three components: (1) A DNS TXT record at _mta-sts.<domain> with version and unique ID, (2) An HTTPS web server at https://mta-sts.<domain> serving a valid mta-sts.txt policy file under /.well-known/ with a trusted SSL certificate, and (3) Inbound MX hosts matching the wildcard patterns defined in the policy.