Enter a domain to read its MTA-STS record, its TLS reporting record, and the policy file that sending servers fetch before they deliver mail to you.
Loading tool…
Lower stack cost. Back in the inbox. Built to send at any scale.
We rebuild it properly: secondary domains, inboxes, SPF, DKIM and DMARC set to enforcement, warmup and safe sending limits, blacklist monitoring on top. Send-ready in about 17 days. No campaigns, no copy, no lead lists. Infrastructure only.
Almost a decade building cold outreach infrastructure, including his own sending and verification stack built from scratch. 20+ B2B clients at companies worth $10M and above, all in tier one countries.
Free · Written plan + fixed price · No sales call required
MTA-STS tells sending servers that your domain expects encrypted delivery, and how to behave when encryption fails. TLS-RPT is the reporting half: it tells those servers where to send daily reports about the failures. This tool reads the TXT record at _mta-sts for your domain, the TXT record at _smtp._tls, and then tries to open the policy file at https://mta-sts.your-domain/.well-known/mta-sts.txt, which is the file sending servers actually act on. If the browser cannot read that file, the tool says so instead of guessing what is inside it.
A complete setup has all three pieces. The _mta-sts record points servers at the policy. The policy file names the MX hosts that are allowed and sets mode: testing only reports on failures, while enforce tells servers not to deliver when TLS cannot be set up or the certificate does not match. max_age is how long a server may cache the policy, in seconds. The _smtp._tls record by itself stops nothing; it only collects the reports you need to spot broken encryption early.
Missing everything is the normal starting point. Publish the _mta-sts TXT record, host the policy file on the mta-sts subdomain over valid HTTPS, and start in mode: testing with a TLS-RPT record in place, so reports arrive before you enforce. Check your MX hosts in the MX Record Checker first, because the policy file has to name them exactly. Move to enforce only when the reports stay clean, and raise max_age as enforcement settles in.
It covers what is broken, what we would build, the timeline, and one fixed price. Want it walked through instead? Book a 15 minute plan walkthrough.
Or just reply to the plan email. Either works.
