hollop.net

Mail server check

One test for a domain’s mail reception: are the MX right, does every mail server speak STARTTLS with a valid certificate, are MTA-STS, TLS-RPT and DANE set up correctly?

STARTTLS on port 25MTA-STS policy checkedDANE against the real certificate
Examples:

Enter a domain, e.g. the part after the @ of your email address. The lookups run through the hollop.net server; nothing is stored.

DNS via DNS over HTTPS; the STARTTLS check is an SMTP connection up to the TLS handshake. No email is sent.

Works together with

SSL Check →An MX certificate on port 25 in detailhands over directlyCAA & DANE →Check or create TLSA records for the MXhands over directlySPF · DMARC · DKIM →SPF, DMARC and DKIM in detailhands over directlyWhois / RDAP →Registrar, expiry and DNSSEC of the domainhands over directly

See all workflows →

What the mail server check covers

Whether email arrives depends on the MX records. Whether it is encrypted and protected from tampering on the way is decided by STARTTLS, MTA-STS and DANE. SPF and DMARC stop others from sending in your name.

MTA-STS and TLS-RPT

STARTTLS alone can be stripped: an attacker in the network removes the offer and the sender delivers unencrypted. MTA-STS (RFC 8461) prevents that. You publish a policy over HTTPS saying which MX are valid and that TLS is mandatory. Senders cache it for max_age seconds.

  1. TXT record _mta-sts.example.com with v=STSv1; id=20261113. Increase the id with every policy change.
  2. The file https://mta-sts.example.com/.well-known/mta-sts.txt with version, mode, one mx line per MX and max_age. Valid certificate for mta-sts.example.com, no redirect.
  3. Start with mode: testing and set up TLS-RPT (_smtp._tls). Once the reports are clean for a few weeks, switch to enforce.

Important: if an MX is missing from the policy or has an invalid certificate, senders in enforce mode stop delivering there. Check the MX certificate in the SSL check with port 25.

DANE

DANE (RFC 7672) binds the certificate to DNS through a TLSA record. It requires DNSSEC for the MX zone. 3 1 1, the SHA-256 hash of the public key, is common. When changing certificates, publish the new TLSA record first, or DANE senders will not deliver. Create and check TLSA records under CAA & DANE.

Port 25 from here

For the STARTTLS check the server opens an SMTP connection on port 25. If the hosting provider blocks that port outbound, the tool says so. The openssl command below the result helps then.

FAQ

What is the difference between MTA-STS and DANE?

Both enforce encrypted delivery. MTA-STS relies on HTTPS and public certificate authorities and works without DNSSEC. DANE stores the certificate in DNS and needs DNSSEC. Google and Microsoft support MTA-STS, many European providers DANE. Using both is possible.

Do I need a web server for MTA-STS?

Yes, a small text file must be served over HTTPS at mta-sts.your-domain. Any web space with a valid certificate will do, such as a subdomain at your host or GitHub Pages.

Why does the check say “port 25 not reachable”?

Either the mail server’s firewall does not allow connections, or our server cannot reach port 25 right now. The tool detects the second case with a cross-check and says so.

Is an email sent during the test?

No. The connection ends right after the TLS handshake, before any sender is given.

Where do I check DKIM?

DKIM depends on the sender’s selector and cannot be queried for a whole domain. In the SPF · DMARC · DKIM tool you can check a specific selector.