MTA-STS checker
Use this MTA-STS checker to read the _mta-sts record, the HTTPS policy file and TLS-RPT reporting. Each MX host is matched against the policy, with a fix for what fails.
Free, no account. Ten checks per hour, shared by our DKIM, blacklist, MTA-STS and BIMI checkers.
Email deliverability checks
Check the sending identity, domain policy, receiving servers and an actual received message together. These checks explain configuration; they cannot certify delivery to an inbox.
- SPF
- Authorize your sending IP and trace the DNS lookup budget.
- DMARC / DKIM
- Check policy, alignment settings, reporting permissions and public keys.
- MX
- Inspect incoming servers, addresses, reverse DNS and the public blocklist.
- Email headers
- Read actual receiver results, forwarding assertions and hop delays locally.
- DKIM
- Read the public key for a selector, or try common provider selectors.
- Blocklists
- Check mail server addresses on DNS blocklists, with removal steps.
- MTA-STS
- Check the TLS policy for incoming mail, its MX match and TLS reports.
- BIMI
- Check the BIMI record, the SVG logo, the certificate and DMARC readiness.
Google and Yahoo bulk sender requirements
Requirements checked 2026-10-12. Google applies its bulk rules above 5000 messages per day to personal Gmail accounts. Yahoo describes bulk senders without publishing the same numeric threshold.
- Publish SPF and sign with DKIM. Publish DMARC with at least p=none, and align the visible From domain with a passing SPF or DKIM identity.
- Use valid forward and reverse DNS and correctly formatted messages. Google also requires TLS transport. Keep reported spam rates below 0.3 percent.
- Marketing and subscribed messages need one-click unsubscribe headers plus a visible unsubscribe link. Honor unsubscribe requests within two days.
- Google requires RSA DKIM keys of at least 1024 bits and recommends 2048 bits. A DNS key check does not prove that outgoing mail is signed.
Spam rate, unsubscribe behavior and real SMTP TLS are outside a DNS check. Verify them with your mail service and a received message.
Google sender guidelinesYahoo sender requirementsYahoo bulk sender definition
An MTA-STS checker tests whether a domain asks senders to deliver its mail over verified TLS. It reads the _mta-sts TXT record, fetches the policy file from the mta-sts host over HTTPS, matches every MX host against the policy and reads the TLS-RPT record. Each problem comes with its fix.
How to use this checker
- Enter your domain
- Use the domain that receives your mail, such as example.com. We read _mta-sts.example.com and _smtp._tls.example.com in DNS.
- Read the policy
- The policy file must be at https://mta-sts.example.com/.well-known/mta-sts.txt, served as text/plain without a redirect. We read it once, after robots.txt, and compare its mx lines with your MX records.
- Move to enforce
- Start with mode: testing and a TLS-RPT address. When the reports show no failures, switch to mode: enforce, raise max_age to at least a week and change the id in DNS.
Questions about this checker
Check your business in AI answers
Email records protect your name in the inbox. The free AI visibility scan shows how ChatGPT and other assistants describe your business.