Question 1

What is the difference between testing and enforce mode?

Accepted Answer

Testing (mode=testing) means policy errors should not block delivery, and you can review what causes failures in reports. Reports come from a separate TLS-RPT record (_smtp._tls) — remember to configure it. mode=enforce means messages that do not meet the rules will not be accepted on non-compliant paths. Stay in testing until this checker confirms correct MX matching and a reachable policy, and TLS-RPT reports do not show recurring errors. Only then raise max_age if needed and switch to enforce.

Question 2

What should the max_age value be?

Accepted Answer

RFC 8461 allows max_age up to about one year (31,557,600 seconds), but in practice most domains use one to several weeks. A very short max_age makes sending servers constantly re-query your policy file and creates needless traffic. A very long value is a trap in an emergency: if you must urgently replace a compromised certificate, other mail servers will remember the old configuration for the full period, which delays the change taking effect.

Question 3

Can MTA-STS break my incoming email?

Accepted Answer

If MTA-STS is misconfigured in enforce mode (for example MX hostnames drift apart or the certificate expires), sending servers will start deferring or rejecting messages, which in practice cuts off inbound delivery. That is why the whole process starts in testing mode.

Question 4

What does this checker test?

Accepted Answer

It verifies the _mta-sts DNS record, fetches the policy file over HTTPS, checks that the TLS/SSL certificate name matches, reads mode and max_age, and compares your live MX hosts to those defined in the policy file. The result is based on public DNS and HTTPS data available at the exact moment of the check.

Question 5

Why must both DNS and the HTTPS policy pass?

Accepted Answer

The DNS record shows that MTA-STS exists at all and points the way to the file; the HTTPS file itself provides the security rules. If either element fails, sending servers will not get a trustworthy policy, so DNS alone is not enough.

Question 6

What does a fail mean, and when should I re-check?

Accepted Answer

Fail means at least one key step did not succeed — for example a missing TXT record, an unreachable policy file, a TLS/SSL certificate problem, or MX hosts that do not match the rules. After you fix the errors, wait for DNS and HTTPS propagation, then run the test again.

Question 7

Does MTA-STS alone fix deliverability or stop spoofing?

Accepted Answer

No. MTA-STS only covers the policy for secure, encrypted connections to MX hosts. SPF, DKIM, and DMARC protect against domain spoofing. Use MTA-STS together with them, because on its own it does not guarantee messages reach the inbox.

Free MTA-STS Checker & Policy Validator