MTA-STS & TLS-RPT

STARTTLS can be stripped by anyone in the path. MTA-STS closes that hole — if the record, the policy file and your MX records all agree.

DNS record missing

Policy file missing

Mode —

TLS-RPT missing

Errors

No MTA-STS recordNothing at _mta-sts.gov.uk begins with v=STSv1. Without it senders never look for a policy, so STARTTLS stays strippable.

Warnings

No TLS-RPT recordWithout _smtp._tls.gov.uk you get no reports of TLS failures, so a policy problem shows up as mail that quietly stops arriving. Publish this before switching MTA-STS to enforce.

Worth knowing

No MX recordsThis domain does not receive mail, so MTA-STS has nothing to protect. If it sends mail, a null MX record ("0 .") states that explicitly.

Also check this domain’s DMARC & SPF, DKIM keys or the certificates its mail servers present.