Best free MTA-STS checkers

AdminKit is built by Netbase JSC. AdminKit is listed below; Hardenize, MxToolbox, EasyDMARC, internet.nl and aykevl.nl are independent and not affiliated with AdminKit.

What’s actually free, sourced from each tool’s own page

Four of the five tools compared here run a free, no-account MTA-STS check today. AdminKit’s MTA-STS check looks up the _mta-sts.<domain> DNS TXT record, fetches the policy file at mta-sts.<domain>/.well-known/mta-sts.txt, and reads back the mode (enforce, testing or none), the MX hosts the policy covers and its max_age. MxToolbox’s MTA-STS Lookup, read 2026-11-07, states it “will check a domain or hostname for an MTA-Strict Transport Security (MTA-STS) DNS TXT record and also for a valid MTA-STS Policy,” with no pricing or account requirement stated on the page. EasyDMARC’s MTA-STS Checker, read 2026-11-07, is presented as a “Free MTA-STS Checker Tool” that “validates both critical components of an MTA-STS setup: the DNS TXT record and the policy file.”

Hardenize’s public report, read 2026-11-07, is also free with no sign-in required to view a domain’s results, and includes a dedicated MTA-STS section inside a much larger domain-security report — DNS, DNSSEC, CAA, TLS certificates, STARTTLS, SPF, DMARC, TLS-RPT, DANE, HTTP/HTTPS and web security headers are all checked on the same report, not just mail. That breadth is Hardenize’s real strength and its real trade-off: it’s not a single-purpose MTA-STS tool the way AdminKit, MxToolbox and EasyDMARC are.

The criteria and weights behind the ranking below

This page ranks the four live, dedicated-enough tools below by what each one’s own page actually demonstrates, not by brand size:

• Reads the full published policy — mode, MX host list and max_age, not just “a record exists” (40%).
• Verifies live enforcement, not just the text — whether the tool actually connects to the listed MX hosts and confirms their TLS certificate matches the policy, versus only reading the policy file (35%).
• Rollout guidance — whether the tool or its surrounding site explains what to do next with the result (15%).
• Actively maintained today — a tool that no longer runs at all cannot be ranked on its features (10%; this is why aykevl.nl’s validator and internet.nl’s general mail test, which does not cover MTA-STS, are excluded from the ranked list below and discussed separately instead).

Scored against those weights, Hardenize ranks first: its own report is the only one among these five that states it opens a live connection to the domain’s mail servers and confirms their certificate actually matches the published policy — real enforcement verification, not just a text read. EasyDMARC and MxToolbox both score well on the first criterion (each reads the DNS record and policy file, per their own pages) but neither page states it performs the live-connection check Hardenize describes. AdminKit also reads the full policy — mode, MX hosts and max_age — but its own tool page states plainly that it “does not open a TLS connection to any MX host,” the same scope limit as MxToolbox’s and EasyDMARC’s tools as far as their own pages describe. AdminKit is not first on this page, and that’s the honest result of the criteria above, not an oversight.

Does Hardenize’s live TLS check mean AdminKit’s MTA-STS check is incomplete?

Not incomplete — narrower in scope, and the scope is stated rather than hidden. AdminKit’s MTA-STS check confirms what a domain has declared: a correctly published _mta-sts record and a policy file with a valid mode, MX list and max_age. That’s the same scope MxToolbox’s and EasyDMARC’s own pages describe for their tools. Hardenize’s report goes one step further and confirms what a domain’s mail servers actually do: it connects to each listed MX host and checks whether its live TLS certificate matches what the policy promises. Both are useful; they’re not the same check, and a domain that passes AdminKit’s, MxToolbox’s or EasyDMARC’s read can still be worth re-checking with Hardenize’s live verification before flipping a policy to enforce, exactly the rollout caution AdminKit’s own MTA-STS guide already recommends.

A transparency note on aykira’s validator and internet.nl

aykevl.nl’s MTA-STS Validator — commonly referenced as “aykira’s MTA-STS tester” — is still named in some MTA-STS roundups and tool lists, but a direct read of its own page on 2026-11-07 states: “This service has been discontinued. Sorry about that,” and recommends Hardenize as an alternative. It’s listed on this page by name for transparency, with its table rows marked honestly rather than silently dropped, but it cannot check a domain today.

internet.nl is a well-known, free, no-account Dutch mail- and connection-security test. Its own mail-test page lists what it checks: IPv6 reachability, DNSSEC signing, SPF/DKIM/DMARC anti-phishing marks, STARTTLS and DANE for secure transport, and RPKI route authorization. MTA-STS is not among them. It’s included here by name, the same way intoDNS is included in AdminKit’s SPF/DMARC roundup for a check it doesn’t perform — a useful, free, real tool, just not a dedicated or partial MTA-STS checker, so its table rows here are marked “not applicable” rather than claiming a feature it doesn’t have.

Related reading

For the DMARC prerequisite that sits alongside MTA-STS in a mail-authentication rollout, see the best free SPF and DMARC checkers roundup. For the BIMI record that depends on that same enforcing DMARC policy, see the best free BIMI checkers roundup. For the full rollout path from testing to enforce, see how to publish and test MTA-STS and MTA-STS, BIMI and TLS-RPT explained. MTA-STS, BIMI and TLS-RPT are all part of AdminKit’s email authentication cluster, alongside SPF, DKIM and DMARC.

---

Trademarks belong to their respective owners; AdminKit is not affiliated with Hardenize, MxToolbox, Inc., EasyDMARC, internet.nl, or aykevl.nl.