Skip to content

Is mail to your domain protected in transit?

Enter a domain to see whether it publishes an enforced MTA-STS policy and TLS reporting for incoming mail, and whether its DNS zone is signed with DNSSEC.

Last reviewed

Reads public DNS and the MTA-STS policy now. Nothing is stored.

Three records that protect delivery and DNS.

SPF, DKIM and DMARC protect against mail forged in your name. These three protect something else: the path mail takes to you, and the DNS answers everything else relies on.

  • MTA-STS tells sending servers to deliver mail to you only over a verified, encrypted connection. Without it, an attacker in the path can strip the encryption.
  • TLS-RPT asks sending servers to report when they could not deliver over TLS, so you find out about a broken certificate or an attack.
  • DNSSEC signs your DNS zone, so resolvers can tell a real answer from a forged one.

What it can find.

What the check findsFindingSeverity
An MTA-STS policy in testing or none modeMTA-STS policy not enforcedMedium45
No TLS-RPT record on a domain that receives mailTLS reporting not configuredLow30
The DNS zone is not signedDNSSEC not enabledMedium60

A domain with no MTA-STS record at all raises no finding in the scan; the check still shows that it is missing. MTA-STS and TLS-RPT only apply to domains that receive mail, so a domain without MX records, or with a null MX, is not judged on them.

Start with TLS reporting.

TLS-RPT is one TXT record at _smtp._tls and changes nothing about delivery, so it is safe to add first:

_smtp._tls.example.com.  3600  IN  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

Then publish MTA-STS in testing mode, read the reports for a few weeks, and switch to enforce once every mail server presents a valid certificate. DNSSEC is switched on at your DNS host, and needs the DS record published at your registrar.

One reading of public DNS.

  • The policy file is fetched, not tested. The check reads the MTA-STS mode from https://mta-sts. followed by your domain; it does not try to deliver mail.
  • DNSSEC through a validating resolver. If the resolver cannot give a clear answer, no DNSSEC finding is shown rather than a guess.

These records are part of the email security module, with DMARC and SPF. The free check covers all six modules.

Sources