MTA-STS Check

What It Does

Queries the _mta-sts.<domain> TXT record for the MTA-STS DNS entry (v=STSv1; id=<policy-id>), fetches the policy file from the well-known URL, validates policy syntax (version tag ordering per RFC 8461 §3.2, mode, mx patterns, max_age), cross-validates MX patterns against actual MX records, and checks for TLS-RPT reporting at _smtp._tls.<domain>. Evaluates the mode progression (none → testing → enforce), validates max_age against recommended ranges (minimum 86,400 for testing, 604,800-31,557,600 for enforce), and detects common issues like DNS record without policy file, mismatched MX patterns, missing policy ID, and version ordering violations. Note: STARTTLS capability of MX servers cannot be verified from this platform (SMTP port 25 is not accessible).

Why It's Useful

MTA-STS prevents email interception by requiring TLS encryption between mail servers (RFC 8461). Without MTA-STS, even domains with HTTPS everywhere can have their emails intercepted via SMTP downgrade attacks — attackers can strip STARTTLS from the initial negotiation. MTA-STS is the email equivalent of HSTS and is complementary to DANE (RFC 7672, which requires DNSSEC). Combined with TLS-RPT, it provides visibility into delivery failures. Adopted by Google (exclusively uses MTA-STS) and Microsoft (supports both DANE and MTA-STS). Required for SOC 2, HIPAA, and GDPR compliance for encrypted email transmission.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/security/mta-sts" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=google.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/security/mta-sts?domain=google.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/security/mta-sts',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'google.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.