Free MTA-STS & TLS-RPT Checker
DMARC proves who sent a message. MTA-STS and TLS-RPT are the other half: they stop mail arriving at your domain from being quietly downgraded to plaintext, and they report it when a connection fails. This checks both and tells you in plain English what is missing. No signup required.
Runs entirely in your browser using public DNS-over-HTTPS. We never store your query.
TLS-RPT reports are just email — point them at PlainDMARC and we read them for you. Publish one TXT record and we turn the raw JSON into a plain-English weekly picture of your inbound encryption, and alert you the day a sender starts failing.
Check the rest of the stack: DMARC checker · SPF checker · DKIM checker · BIMI checker
Frequently asked questions
What is MTA-STS?
MTA-STS (SMTP MTA Strict Transport Security) lets your domain tell sending mail servers "always use TLS to deliver to me, and refuse to fall back to plaintext." It is published as a TXT record at _mta-sts.yourdomain.com plus a policy file served over HTTPS at mta-sts.yourdomain.com/.well-known/mta-sts.txt. Without it, an attacker on the network path can strip encryption and read inbound mail.
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting) is the reporting half. It publishes a TXT record at _smtp._tls.yourdomain.com with an address, and sending servers email you a daily JSON report of how many delivery connections succeeded or failed to encrypt. It is the only way to find out that inbound mail to you is being downgraded — and PlainDMARC reads those reports for you.
Does this checker fetch my MTA-STS policy file?
No. Browsers cannot fetch the policy file at another domain (cross-origin rules), so this tool verifies the DNS parts — the _mta-sts record and whether the mta-sts host resolves — and tells you to confirm the file itself by opening the URL. The record without a reachable policy file does nothing, so both matter.
Do MTA-STS and TLS-RPT put my mail at risk?
No. Both are about mail coming in to you, and both fail safe: a sender that cannot fetch your MTA-STS policy falls back to its previous cached policy, and TLS-RPT is purely reporting. Publishing them cannot bounce your mail — unlike a too-strict SPF or DKIM change.
A one-off check is a snapshot — DMARC needs watching
PlainDMARC monitors your domains continuously and sends a weekly plain-English verdict per domain — what passed, what failed, and what to fix.