MTA-STS policy parser

What this tool checks

The text is read line by line as RFC 8461 section 3.2 describes, with the reader of the MTA-STS check:

Format: every line must be key: value; a byte order mark and CRLF line ends are accepted.
Fields: version, mode, max_age and every mx pattern (a host name or *. and a host name).
Mode: testing (MTASTS_MODE_TESTING) and none (MTASTS_MODE_NONE).

How to read the result

A valid policy shows its mode, max_age and mx patterns. Problems are listed in the order the lines appear, up to five.

Limitations

Nothing is fetched: whether the file is served at the well-known URL with a valid certificate, and whether the MX hosts match, needs the MTA-STS check.

Use it from code

API reference for MTA-STS policy parser

curl -i -X POST https://api.lookproof.dev/v1/mail/mta-sts-parse \
  -H 'content-type: application/json' \
  -d '{"policy": "version: STSv1\nmode: testing\nmx: mx1.example.com\nmx: *.mail.example.com\nmax_age: 604800\n"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	MTA-STS policy file
Deadline	2 seconds
Freshness	Computed from the input; nothing is looked up
Price	$0.002 per check

Findings this tool can report

MTA-STS (4)

Error MTASTS_INVALID_POLICY The MTA-STS policy file is not valid.
Warning MTASTS_LOW_MAX_AGE The MTA-STS policy has a max_age below one day.
Info MTASTS_MODE_NONE The MTA-STS policy is in mode none.
Warning MTASTS_MODE_TESTING The MTA-STS policy is in testing mode.

Frequently asked questions

What must an MTA-STS policy contain?

version: STSv1, a mode of enforce, testing or none, a max_age in seconds and, unless the mode is none, at least one mx line. Keys are case-sensitive, and a line that does not parse makes the whole policy invalid: MTASTS_INVALID_POLICY.

Which max_age should I use?

Senders cache the policy for max_age seconds. RFC 8461 suggests weeks; below one day the tool reports MTASTS_LOW_MAX_AGE, because a short lifetime leaves room to block the policy fetch.

How is this different from the MTA-STS check?

The MTA-STS check looks up the _mta-sts record, fetches the policy over HTTPS and compares its mx patterns with the domain's MX hosts. The parser reads only the text you paste, with the same reader.