{"uid":"cap_2zbG3oh7ZexRFxtaWh-Xz","slug":"probekit-mta-sts-check-1217a314","name":"ProbeKit MTA-STS Check","description":"Check a domain's MTA-STS setup (RFC 8461): the _mta-sts record, the HTTPS policy file with certificate check and no redirects, mode, max_age and whether every MX host is covered, plus the TLS-RPT record (RFC 8460). Use when an agent must tell whether inbound mail is protected against TLS downgrade, or why senders report MTA-STS failures for a domain.","url":"https://api.probekit.dev/v1/mail/mta-sts?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_gB9M9l-lgKVAsZKm_XNvo","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a domain's MTA-STS policy (RFC 8461) and TLS-RPT record (RFC 8460), including DNS record presence, HTTPS policy file retrieval, certificate validity, mode, max_age, and MX host coverage.","exampleAgentPrompt":"Can you check whether mta-sts.example.com has a valid MTA-STS setup — I want to know if the policy file is reachable and correctly signed, what mode it's in, whether all MX hosts are covered, and if there's a TLS-RPT record?","exampleUseCases":[{"title":"Diagnosing MTA-STS delivery failures","prompt":"Senders are reporting MTA-STS validation errors when delivering mail to acmecorp.com — can you check the MTA-STS configuration and tell me exactly what's broken, including whether the policy file is reachable, the certificate is valid, and all MX hosts are listed?"},{"title":"Pre-deployment MTA-STS audit","prompt":"We're about to enforce MTA-STS for mailservice.io — before we flip the mode to enforce, can you verify the _mta-sts record, policy file, TLS cert, max_age, and MX coverage are all correct?"},{"title":"Checking TLS-RPT reporting readiness","prompt":"Does example.org have a TLS-RPT record set up alongside its MTA-STS policy so senders can report delivery failures?"}],"resultDescription":"Returns a structured report covering: presence and content of the _mta-sts TXT DNS record, the HTTPS MTA-STS policy file (fetched without redirects, with TLS certificate validation), policy mode (none/testing/enforce), max_age value, which MX hosts are and aren't covered by the policy, and the TLS-RPT DNS record (RFC 8460) including reporting endpoints.","failureModes":["Domain does not exist or has no DNS — returns error or empty results","_mta-sts record missing — flagged as not configured","Policy file unreachable over HTTPS — connection or certificate error reported","Policy file redirects detected — flagged as non-compliant per RFC","MX hosts not covered by policy — listed as uncovered","TLS-RPT record absent — flagged as missing","Malformed policy file syntax — parse errors reported","Invalid or expired TLS certificate on mta-sts hostname — flagged"],"whenToPreferThis":"Use this endpoint when you specifically need to audit or debug MTA-STS (RFC 8461) and TLS-RPT (RFC 8460) configuration for a domain — it goes deeper than a generic mail check by fetching and validating the HTTPS policy file, checking TLS certificates, verifying MX coverage, and inspecting TLS-RPT. Prefer the full mail report endpoint if you also need SPF, DMARC, and MX together in one call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T19:05:50.652Z","isFirstParty":false,"canonicalSlug":"probekit-mta-sts-check-1217a314"}