Mail server security check
Is mail sent to your domain encrypted, and can it be downgraded? Tests every MX server.
What this checks
The check connects to each mail server (MX) for the domain the way another mail server would, upgrades to TLS and reads the settings, then disconnects.
- STARTTLS offered on every mail server, and the TLS version used
- Certificate: trusted, matching the MX name, and days until expiry
- Whether old TLS 1.0 / 1.1 is still accepted
- Open relay: whether the server accepts mail for outside domains
- MTA-STS policy, TLS-RPT reporting and DANE (TLSA) records
Questions
What is STARTTLS?
It’s how mail servers switch an SMTP connection to encrypted TLS. Without it, mail sent to your domain crosses the internet in plain text.
Why does MTA-STS matter?
STARTTLS is optional, so an attacker on the network can strip it and read mail. An MTA-STS policy in enforce mode tells sending servers to only deliver over valid, encrypted connections.
Is the open-relay test safe?
Yes. It asks the server whether it would accept mail for an address at example.com, then resets and disconnects before any message is sent.