Specialist check
MTA-STS and TLS-RPT checker
Review optional inbound transport protections. The result separates best practices from cold email launch requirements.
- Checks
- Reads MTA-STS and TLS-RPT DNS records plus the public MTA-STS policy host.
- Cannot tell
- These controls protect inbound transport. They are not universal requirements for outbound cold email.
Expected time: about 5 to 20 seconds. Some public services can take longer.
Source: Live Google Public DNS plus a browser request to the public MTA-STS policy host.
Questions
It checks the _mta-sts TXT record, the policy id, whether the MTA-STS policy host accepts HTTPS, and the policy mode when the browser can read the policy file.
It checks the _smtp._tls TXT record and confirms the record includes a rua reporting destination for TLS failure reports.
No. MTA-STS protects inbound mail to your domain. For cold email launch QA it is a security posture signal, not a substitute for SPF, DKIM, DMARC, unsubscribe handling, and tracking-domain checks.
Many MTA-STS policy hosts do not allow browser CORS reads. In that case this checker can verify HTTPS reachability, but cannot safely parse the policy body without a backend proxy.
Related checks