Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Network
  3. MTA-STS checker
Your files stay on your device

MTA-STS checker

Check a domain's MTA-STS DNS record and HTTPS policy file, and whether the policy covers its real MX hosts.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Press the button to run the check

Nothing leaves this page until you do. The tool reads the DNS record, fetches the policy file at mta-sts.<domain>/.well-known/mta-sts.txt, resolves the live MX hosts, and checks that the policy's patterns actually cover them.

RFC 8461 has three halves and they all have to agree: the _mta-sts TXT record, the HTTPS policy file, and the MX list. This tool reads all three but opens no SMTP connection: it cannot check the TLS certificates your MX hosts present, and it does not model a sender's cached-policy behavior. A policy pattern may start with *. to match exactly one leading label; anything else is matched literally.

Domain

One hostname per run, like example.com
More settings▾
DNS resolverWhere the record and MX questions go

Three probes run at once against a shared 8 second budget: the _mta-sts TXT record, the policy file, and the live MX list.

What leaves your browser

Two DNS questions (_mta-sts TXT, MX) go browser-direct to the DoH resolver you picked, and the policy file is fetched through this project's capped proxy server (GET only, public hosts only, size and time caps, rate-limited), because a browser cannot fetch mta-sts.<domain> cross-origin. The proxy never follows redirects, which is what RFC 8461 wants anyway: a redirect comes back as a warning, not as a followed chain. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

More network tools

  • Live DNS lookup
  • DNS explainer
All network tools

Was this tool useful?