MTA-STS Checker

Reads the record at _mta-sts.<domain>, fetches the policy file itself from mta-sts.<domain> over HTTPS, and cross-checks the policy's mx list against the domain's actual MX records — the mismatch that silently bounces mail from every sender honouring the policy. Also checks TLS-RPT, which is how you'd otherwise find out.

What this checks

Whether a v=STSv1 record exists at _mta-sts.<domain>, and whether it carries a valid id. More than one record means senders treat the domain as having no policy at all.
Whether the policy file is actually retrievable at https://mta-sts.<domain>/.well-known/mta-sts.txt. A missing policy host, a certificate that doesn't cover the mta-sts subdomain, and a redirect (which senders are forbidden from following) are all reported separately, because they have different fixes.
The policy's mode, max_age and mx entries — including whether every MX host in DNS is actually covered by a pattern. Under mode: enforce an uncovered host means mail is bouncing right now; under mode: testing the same gap is a warning, because senders still deliver.
TLS-RPT at _smtp._tls.<domain> — without it, a policy in testing mode is generating no evidence at all.

Building a policy rather than checking one? The MTA-STS Policy Generator produces the policy file and every DNS record it needs, entirely in your browser. Background in what MTA-STS and TLS-RPT actually do.