MTA-STS & TLS-RPT Check

SMTP upgrades to TLS opportunistically, so anyone in the path can strip the upgrade and read the mail. MTA-STS publishes a policy saying "always use TLS, and these are my mail servers"; TLS-RPT is how you find out when that fails. This checks both, and compares the policy against the MX records you actually publish.

Domain: Scheme and path are optional — https://example.com/page works too.

Check policy