MTA-STS checker

Check a domain's MTA-STS record, fetch its policy file, and confirm the policy covers every mail exchanger the domain actually publishes.

What this catches

Every problem below is one this tool detects and explains, with the record to publish.

An MX host does not resolve to an address
A mail exchanger is published but its hostname has no A or AAAA record.
An MX host resolves to a private address
A published mail exchanger points into private address space and is unreachable from the internet.
An MX record points at an alias
MX targets must be hostnames with address records, not CNAMEs.
Domain declares that it does not accept mail
A null MX record is published, which is the correct way to say so.
MTA-STS is not configured
The domain does not publish an MTA-STS policy. This is optional but worth having.
MTA-STS policy does not cover all published mail exchangers
An MX host in DNS is not listed in the policy file.
MTA-STS policy is in testing mode
Failures are reported but not acted on, so the policy is not yet protecting mail.
MTA-STS record published but the policy file is unreachable
The DNS record announces a policy that cannot be fetched.
No MX records found
This domain publishes no mail exchangers, so it cannot receive email.
Only one mail exchanger is published
There is no backup path if this host becomes unreachable.