Laravel
← Back to all checks

Email

Mail server TLS

Checks that your mail servers encrypt incoming email with STARTTLS, publish MTA-STS and TLS-RPT, and have matching reverse DNS so your mail is not marked as spam.

How it works

Once a day, we check how securely other servers can deliver email to your domain:

  • MX resolution: your mail server's name must resolve. Otherwise incoming mail is lost.
  • STARTTLS: your mail server must offer encryption on port 25. Without it, mail reaches you in plain text. Many networks block port 25, in which case this test is skipped.
  • MTA-STS: a policy that tells sending servers to insist on encryption, instead of quietly falling back to plain text. It should be in enforce mode.
  • TLS-RPT: a DNS record where sending servers report delivery problems with encryption.
  • Reverse DNS: your mail server's IP address should have a PTR record that matches its name. Receivers mark mail from servers without one as spam.

Statuses

Status Meaning
OK Mail is encrypted and every record is in place.
Warning No MTA-STS policy, MTA-STS in testing mode, no TLS-RPT record, no matching reverse DNS, or the MX lookup failed.
Failed The mail server does not resolve, or it does not offer STARTTLS.

By default you are notified of failures only.

Fixing common problems

  • No STARTTLS: enable TLS in your mail server with a valid certificate. Hosted providers (Google Workspace, Microsoft 365) already offer it.
  • No MTA-STS: publish a TXT record at _mta-sts.yourdomain (v=STSv1; id=20261014) and a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt listing your MX hosts with mode: enforce.
  • No TLS-RPT: add a TXT record at _smtp._tls.yourdomain: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.
  • No reverse DNS: set the PTR record at your hosting provider (it belongs to the IP address, not to your domain).