What is MTA-STS? Mail TLS policy + free MTA-STS checker
MTA-STS is how you insist that other mail servers speak TLS when they deliver to you—not plaintext when an attacker strips STARTTLS on the wire. A free MTA-STS checker confirms both the DNS id and the HTTPS policy file before you raise mode.
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) is a published policy that tells supporting senders: deliver to our MX over TLS, or do not silently fall back to cleartext. It is not a replacement for SPF, DKIM, or DMARC—those protect sending trust. MTA-STS protects the inbound hop to your mail hosts.
The two halves (DNS id + HTTPS policy)
MTA-STS needs both sides live. DNS: TXT at _mta-sts.yourdomain with v=STSv1 and an id= token you bump whenever the policy changes. HTTPS: a file at https://mta-sts.yourdomain/.well-known/mta-sts.txt that starts with version: STSv1 and lists mode, mx: hosts, and max_age. Publish only the DNS half or only the file and senders cannot treat the policy as complete—an MTA STS checker that only looks at TXT will miss a 404 policy.
What the policy file looks like
A minimal testing policy looks like: version: STSv1, mode: testing, one or more mx: lines matching your real MX hostnames, and max_age in seconds (often 86400 while you learn). Mode testing means senders report but do not hard-fail; move to enforce when TLS-RPT looks clean and MX names match the certificate. Wrong mx: lines are the classic “policy published, still broken” mistake.
What CrowWake checks
We look up TXT at _mta-sts.yourdomain for a v=STSv1 id record, and we fetch https://mta-sts.yourdomain/.well-known/mta-sts.txt for a version: STSv1 policy. When the file is there, we decode mode, mx hosts, and max_age so you can see testing vs enforce without opening the raw file. Both present → ok. Only one side live → warn. Neither → warn (optional but recommended). The free MTA-STS checker uses the same two signals with no login. For the repeat “watch this hourly” job, see the dedicated MTA-STS monitoring guide.
How to check MTA-STS (free MTA-STS checker)
1) Run the free MTA-STS checker on the bare domain. 2) Confirm DNS shows a v=STSv1 id (not just any TXT). 3) Confirm the policy URL returns 200 over HTTPS with version: STSv1. 4) Compare mx: lines to your live MX hosts (use the free MX checker). 5) Publish TLS-RPT so you get failure reports, then add the domain so CrowWake crows if either half disappears.
MTA-STS vs MTA-STS monitoring
This guide is the definition and publish/triage job: what MTA-STS is, how the DNS id + HTTPS policy pair works, and how to check MTA-STS with a free MTA-STS / MTA STS checker. MTA-STS monitoring is the hourly rooster—catch a wiped _mta-sts TXT, a 404 on mta-sts., or a cert expiry that makes the policy look missing. Both use the same free checker; CrowWake just repeats the pulse.
Why it matters
Classic SMTP can fall back to cleartext if STARTTLS is stripped. MTA-STS publishes a policy so supporting senders refuse insecure delivery instead of silently downgrading. Agencies lose the mta-sts hostname or the TXT id during zone rebuilds and only notice when TLS reports go quiet—or never arrive—especially once mode moves toward enforce.
What “good enough” looks like
DNS id that bumps when the policy changes. A reachable mta-sts hostname with a valid TLS cert serving /.well-known/mta-sts.txt. Policy mx: lines that match real MX. Mode testing → enforce when ready. max_age long enough that caches stay stable. TLS-RPT published so you are not flying blind.
Publish checklist (order matters)
1) Confirm MX with the free MX checker. 2) Host mta-sts.yourdomain (A/AAAA or CDN) with HTTPS. 3) Upload /.well-known/mta-sts.txt in testing mode. 4) Add TXT at _mta-sts with v=STSv1; id=… . 5) Re-run the free MTA-STS checker until both halves are green. 6) Add TLS-RPT, watch reports, then flip mode to enforce and bump id=.
If CrowWake crows
Partial setup → finish both DNS and the policy file (many teams publish one and forget the other). Policy 404 or wrong host → point mta-sts.yourdomain at hosting that serves /.well-known/mta-sts.txt over HTTPS. Cert errors on that host count as missing policy. After edits, bump the DNS id so senders refetch. Re-check with the free MTA-STS checker, then confirm CrowWake goes green.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free MTA-STS checker with no login.
Deep dive: MTA-STS monitoring — watch DNS id + HTTPS policy so a silent half-wipe crows early, with the same free MTA-STS / MTA STS checker.
The free MTA-STS checker lists the live _mta-sts id and policy file. Pair with TLS-RPT monitoring, TLS-RPT / TLS reporting, MX monitoring, and the free MX checker so policy mx: lines match real hosts.