MTA-STS & TLS-RPT Auditor

Audits a public domain's SMTP MTA Strict Transport Security (MTA-STS) policy (RFC 8461) and SMTP TLS Reporting (TLS-RPT) record (RFC 8460) in one API call. Checks the _mta-sts DNS TXT record, fetches and parses the HTTPS policy file, resolves MX records and matches them against policy patterns, and checks the _smtp._tls TLS-RPT TXT record. Returns a readiness score, grade, issues, and actionable recommendations.

Use cases

• Email deliverability and transport security checks before migrating email providers.
• Security audits for MTA-STS policy enforcement and TLS-RPT reporting across client domains.
• Compliance checks for SMTP transport encryption downgrade resistance.
• Onboarding checks when adding a new domain to email infrastructure.
• Scheduled monitoring for MTA-STS policy drift, expired policy files, or MX coverage gaps.

Input

Field	Type	Required	Description
startUrl	string	Yes	Public domain or URL to audit. The actor extracts the hostname and checks MTA-STS DNS and HTTPS policy, MX records, and TLS-RPT DNS. HTTP and HTTPS only. Private IP ranges are blocked.
timeoutSeconds	integer	No	Timeout for DNS queries and HTTP fetch from 3 to 30 seconds. Default: 10.

Output

Each run pushes one dataset item.

Field	Type	Description
inputUrl	string	Original input URL or domain.
domain	string	Extracted domain name used for DNS and HTTP lookups.
checkedAt	string	ISO timestamp for the audit.
mtaSts	object	MTA-STS audit results (see below).
tlsRpt	object	TLS-RPT audit results (see below).
score	integer	Transport security readiness score from 0 to 100.
grade	string	Letter grade from A to F.
issues	array	Human-readable issues found.
recommendations	array	Recommended fixes.
error	string or null	Error message, if any.

MTA-STS object

Field	Type	Description
dnsRecord	string or null	Raw _mta-sts.<domain> TXT record.
recordFound	boolean	Whether an MTA-STS DNS record exists.
recordId	string or null	Policy id from the DNS record.
policyFileUrl	string or null	Policy file URL that was fetched.
policyFileFetched	boolean	Whether the policy file was fetched successfully.
policyFileStatus	integer or null	Policy file HTTP status code.
policyFileHttps	boolean	Whether the policy file was served over HTTPS.
policyContentType	string or null	Policy file Content-Type header.
rawPolicy	string or null	Raw policy file text.
version	string or null	Policy version (expected STSv1).
mode	string or null	Policy mode: enforce, testing, or none.
mxPatterns	array	MX patterns from the policy file.
maxAge	integer or null	Policy max_age in seconds.
mxRecords	array	Resolved MX hostnames sorted by priority.
mxMatch	object	MX matching results (matched, unmatched, allMatch, issues).
issues	array	MTA-STS-specific issues.

TLS-RPT object

Field	Type	Description
dnsRecord	string or null	Raw _smtp._tls.<domain> TXT record.
recordFound	boolean	Whether a TLS-RPT record exists.
version	string or null	TLS-RPT version tag (expected TLSRPTv1).
rua	string or null	Report destination (rua).
ruaSchemes	array	Schemes used in rua destinations (mailto, https).
issues	array	TLS-RPT-specific issues.

Example input

{
  "startUrl": "https://example.com",
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com",
  "domain": "example.com",
  "checkedAt": "2026-08-17T00:00:00.000Z",
  "mtaSts": {
    "dnsRecord": "v=STSv1; id=20260101A1",
    "recordFound": true,
    "recordId": "20260101A1",
    "policyFileUrl": "https://mta-sts.example.com/.well-known/mta-sts.txt",
    "policyFileFetched": true,
    "policyFileStatus": 200,
    "policyFileHttps": true,
    "policyContentType": "text/plain",
    "rawPolicy": "version: STSv1\nmode: enforce\nmx: mail.example.com\nmax_age: 604800\n",
    "version": "STSv1",
    "mode": "enforce",
    "mxPatterns": ["mail.example.com"],
    "maxAge": 604800,
    "mxRecords": ["mail.example.com"],
    "mxMatch": {
      "matched": ["mail.example.com"],
      "unmatched": [],
      "allMatch": true,
      "issues": []
    },
    "issues": []
  },
  "tlsRpt": {
    "dnsRecord": "v=TLSRPTv1; rua=mailto:tls-reports@example.com",
    "recordFound": true,
    "version": "TLSRPTv1",
    "rua": "mailto:tls-reports@example.com",
    "ruaSchemes": ["mailto"],
    "issues": []
  },
  "score": 100,
  "grade": "A",
  "issues": [],
  "recommendations": [],
  "error": null
}

Security

• Accepts only public HTTP and HTTPS URLs or domains.
• Rejects URL credentials (user:pass@host).
• Rejects localhost, private IPv4, private IPv6, link-local, and private DNS resolutions.
• Fetches only the MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt over HTTPS with SSRF-safe redirect revalidation.
• Performs DNS TXT and MX lookups only for _mta-sts.<domain>, _smtp._tls.<domain>, and <domain> MX.
• Does not collect credentials or private data.
• Does not fetch URLs referenced inside the policy file or TLS-RPT record.

Pricing

Suggested pay-per-event pricing:

Event	Price
Actor start	$0.005
Domain audited	$0.01

Typical one-domain run cost: about $0.015 before Apify platform charges. Apify keeps its standard commission and the actor owner receives the remainder.

FAQ

What is MTA-STS?

MTA-STS (SMTP MTA Strict Transport Security, RFC 8461) is a standard that lets a domain declare that inbound SMTP connections must use TLS with a valid certificate and a specific set of MX servers. It prevents TLS downgrade and STARTTLS stripping attacks. It uses a DNS TXT record at _mta-sts.<domain> to signal policy existence, and an HTTPS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt to define the policy.

What is TLS-RPT?

TLS-RPT (SMTP TLS Reporting, RFC 8460) is a companion standard that lets a domain request reports about TLS delivery failures from sending MTAs. It uses a DNS TXT record at _smtp._tls.<domain> with a rua= destination (mailto or HTTPS endpoint).

Does this actor check DANE TLSA records?

No. DANE TLSA (RFC 7672) is a separate transport security mechanism that requires DNSSEC. This actor focuses on MTA-STS and TLS-RPT. Use the DNSSEC Validator actor for DNSSEC chain-of-trust checks.

Does this actor send test emails?

No. It only performs DNS lookups and fetches the MTA-STS policy file over HTTPS. It does not send SMTP traffic or test mail delivery.

What is the scoring based on?

The score starts at 100 and is reduced for: missing MTA-STS DNS record (-40), missing or unfetchable policy file (-25), policy mode none (-15) or testing (-5), missing required policy keys, MX records not covered by policy patterns (-15), no MX records (-10), missing TLS-RPT record (-15), and missing or invalid TLS-RPT rua (-5).

Kill or keep metric

Keep this actor if it gets organic Store impressions, runs, revenue, or inbound questions within 60 to 90 days. Improve the listing or pricing if impressions arrive without runs. Archive it if there is no discovery or usage.