Free tool
Incoming mail check
Which servers receive your email, do they encrypt the connection, is their certificate valid, and do you enforce encryption with MTA-STS? We connect to each server the way a sender would, without sending anything.
What this check covers
MX
Who receives
The servers listed in your DNS, in priority order. If the first fails, senders try the next.
STARTTLS
Encryption
The server offers to encrypt the connection. Without it, emails travel in the clear between servers.
MTA-STS
Enforced encryption
Optional. Tells senders to refuse delivery if encryption or the certificate fails.
Sending is another matter
This tool checks how you receive email. For what you send (SPF, DKIM, DMARC), see the SPF, DKIM & DMARC checker.
Frequently asked questions
Is my email received and encrypted properly?
Enter your domain name: the tool lists the servers that receive your email and connects to each one the way a sender would, without sending anything. It shows whether they offer encryption, whether their certificate is valid and whether MTA-STS is in place.
What is STARTTLS?
It is the server offering to encrypt the connection with whoever sends it a message. Without that offer, email travels in the clear between servers.
What is MTA-STS for?
MTA-STS is optional. It tells senders to refuse delivery if encryption or the certificate fails, rather than sending the message unencrypted anyway. It is a stricter safeguard than STARTTLS alone.
Does this tool also check what I send?
No, only how you receive email. For what you send (SPF, DKIM and DMARC), use the site's SPF, DKIM and DMARC checker, which is a separate tool.
