About the MTA-STS, TLS-RPT & BIMI Checker
These three standards sit on top of SPF, DKIM and DMARC. MTA-STS (RFC 8461) tells sending servers that your domain only accepts mail over TLS with a valid certificate, which stops an attacker from silently downgrading the connection. TLS-RPT (RFC 8460) asks senders to email you a daily report of TLS failures. BIMI shows your logo next to your messages in Gmail, Apple Mail and Yahoo.
The checker reads the _mta-sts TXT record (v=STSv1; id=…), fetches the policy from https://mta-sts.<domain>/.well-known/mta-sts.txt without following redirects, and requires a valid certificate, as senders do. It parses the version, mode (enforce, testing or none), mx patterns and max_age, then checks that every real MX host matches a pattern. A wildcard such as *.mail.example.com covers exactly one label. It doesn't connect to port 25, so the certificates on the MX hosts themselves aren't checked.
For TLS-RPT it reads _smtp._tls and validates the rua= addresses. For BIMI it reads default._bimi, fetches the logo and checks that it is an SVG Tiny PS file (baseProfile="tiny-ps", a title, no scripts or external references, under 32 KB), reads the mark certificate at a=, and confirms DMARC is at p=quarantine or p=reject with pct=100.
How to use it
- Enter a domain, or an email address.
- Select Check policies.
- Fix anything marked Fail first, then Warn. Each note says what to change.
Examples
- Check google.com: MTA-STS in enforce mode with wildcard MX patterns, and TLS-RPT.
- Check gmail.com: every alt MX matched by one wildcard.
Common questions
Should I start in enforce mode?
No. Publish mode: testing with TLS-RPT for a few weeks, read the reports, then switch to enforce and raise max_age to at least a week.
Why must I change the id when I edit the policy?
Senders cache the policy for max_age seconds and only fetch it again when the TXT record's id changes.
Do I need a certificate for BIMI?
Yahoo shows logos without one; Gmail and Apple Mail need a Verified Mark Certificate or a Common Mark Certificate.
Related tools
- SPF, DKIM & DMARC Checker: the records BIMI depends on.
- DMARC Record Generator: build an enforcing DMARC policy.
- SSL Inspector: inspect the certificate on mta-sts.yourdomain.