MTA-STS & TLS-RPT
STARTTLS can be stripped by anyone in the path. MTA-STS closes that hole — if the record, the policy file and your MX records all agree.
Try google.com, microsoft.com or gov.uk
What this checks
The problem MTA-STS solves
STARTTLS is opportunistic. An attacker on the path deletes it from the server greeting, the sender shrugs and delivers in plain text, and nobody is told. Encryption you can remove by asking is not encryption.
Three things that must agree
A TXT record at _mta-sts, a policy file served over HTTPS at the .well-known path, and the MX records themselves. We fetch all three and compare them.
The coverage check
The common failure is an MX host missing from the policy. In testing mode that is invisible. In enforce mode it is mail that bounces — so we flag it either way.
TLS-RPT first
Publish reporting before enforcing. It is the difference between finding out about a broken policy from a daily report and finding out from a customer who never got your invoice.