Free tool

MTA-STS and TLS-RPT checker

Check whether a sending or brand domain publishes MTA-STS and TLS-RPT records as part of its cold email security posture.

This checks MTA-STS and TLS-RPT records for one domain. For a real launch verdict, run every domain, inbox, and tracking domain through the full QA pass.

Runs live in your browser via public DNS. Nothing is stored.

Security posture beyond SPF, DKIM, and DMARC

MTA-STS tells senders that inbound mail to your domain should use verified TLS. TLS-RPT tells receivers where to send reports when TLS delivery fails.

These records do not make a cold email campaign ready by themselves. They show whether the domain is operated with a stronger mail security baseline before clients, prospects, or receiving systems inspect it.

What to fix before launch

A missing record is usually a review item. A malformed record, duplicate record, missing policy id, or unreachable MTA-STS policy host is the part to fix first.

For launch signoff, keep this check beside the required sender checks. OutboundQA reviews MTA-STS and TLS-RPT with SPF, DKIM, DMARC, MX, blacklist, tracking-domain, and receiver requirement evidence.

How to read the result

A pass means the records are present and the policy evidence is usable from the browser check. A warning means a signal is missing or the policy file could not be parsed from the browser. A fail means a published record or policy path appears broken.

What this check does not catch

A passing MTA-STS and TLS-RPT records lookup is useful, but it is not launch signoff. Cold email campaigns still fail when adjacent records, tracking domains, or inbox-level settings are broken.

SPF records

DKIM selectors

DMARC policy

MX readiness

tracking-domain SSL

blacklist status

Setup guides for this check

Read the setup notes behind this result, then verify the neighboring records before launch.

Google and Yahoo bulk sender requirements

SPF, DKIM, DMARC, one-click unsubscribe, and the spam-rate thresholds bulk senders must meet.

DMARC for cold email

Policies, alignment, rua reports, and the Gmail and Yahoo requirement that made DMARC mandatory.

MX records and mail routing

How MX records route replies and bounces, provider records for Google and Microsoft, and common mistakes.

Need to check a full outbound workspace?

OutboundQA checks every domain, inbox, and tracking domain in the workspace, then gives you a shareable report with a Ready, Needs Fix, or Do Not Launch verdict.

Run a free workspace check View a sample report

Cold email launch checks to run next

Use this result as one checkpoint in the launch flow. Then verify the neighboring records and run the combined domain check before the outbound launch goes live.

SPF Checker

Look up a domain's SPF record and count its DNS lookups against the limit of 10.

DMARC Checker

Look up a domain's DMARC record and read its policy in plain English.

DKIM Checker

Look up a domain's DKIM selector and confirm the public key exists.

Auth Checker

Run SPF, DKIM, and DMARC together for a sending domain before launch.

MX Checker

Look up a domain's MX records and detect the mail provider.

Blacklist Checker

Check a domain and sampled mail server IPs against domain and email blocklists.

Reputation Checker

Check observable cold email reputation risks across age, blacklist, authentication, MX, and HTTPS signals.

Deliverability Checker

Check observable cold email infrastructure readiness across MX, SPF, DKIM, DMARC, blacklist, age, tracking-domain, and SMTP egress identity signals.

Receiver Checker

Check observable Gmail, Yahoo, and Microsoft sender requirements from public DNS and optional pasted message headers.

Recipient Preflight

Paste emails or domains and classify MX provider, free inboxes, security gateways, SPF, DMARC, and receive-mail readiness.

Tracking Checker

Check a branded cold email tracking domain for CNAME setup, DNS resolution, HTTPS, and redirect handoff.

PTR/rDNS Checker

Check a custom SMTP egress IP for PTR, reverse DNS, and forward-confirmed rDNS before launch.

Launch Checklist

Generate a pre-launch QA checklist for domains, inboxes, authentication, tracking domains, blacklist checks, and signoff.

Domain Checker

Run MX, SPF, and DMARC in one pass for a quick readiness verdict on a sending domain.

Sample Launch QA Report

See the report founders, teams, and agencies can share after the full QA pass.

Email Deliverability Tool

See how one-off checks turn into pre-launch QA for full cold email workspaces.

Questions

It checks the _mta-sts TXT record, the policy id, whether the MTA-STS policy host accepts HTTPS, and the policy mode when the browser can read the policy file.

It checks the _smtp._tls TXT record and confirms the record includes a rua reporting destination for TLS failure reports.

No. MTA-STS protects inbound mail to your domain. For cold email launch QA it is a security posture signal, not a substitute for SPF, DKIM, DMARC, unsubscribe handling, and tracking-domain checks.

Many MTA-STS policy hosts do not allow browser CORS reads. In that case this checker can verify HTTPS reachability, but cannot safely parse the policy body without a backend proxy.

More free tools

SPF