MTA-STS Policy Checker

Check supplied MTA-STS DNS, policy-file, HTTP-status, and MX-host evidence for enforcement readiness and coverage gaps.

Inputs

• domains: Domain evidence with txt, policy, policyStatus, and mxHosts.
• maxDomains: Maximum paid domain rows to emit.
• includeReport: Create Markdown and JSON report artifacts.
• maxChargeUsd: Stop before the next PPE event would exceed the run budget.

{
  "domains": [
    {
      "domain": "gmail.com",
      "txt": "v=STSv1; id=20190429T010101;",
      "policy": "version: STSv1\nmode: enforce\nmx: smtp.google.com\nmx: gmail-smtp-in.l.google.com\nmx: *.gmail-smtp-in.l.google.com\nmax_age: 86400",
      "policyStatus": 200,
      "mxHosts": ["gmail-smtp-in.l.google.com", "alt1.gmail-smtp-in.l.google.com"]
    }
  ],
  "maxDomains": 1,
  "includeReport": true,
  "maxChargeUsd": 1
}

Dataset

Rows report DNS validity, policy reachability, policy mode, max_age, policy MX patterns, supplied-MX coverage, issues, warnings, and status. Missing MX evidence is reported explicitly rather than replaced with an assumed host.

Billing

The pay-per-event billing events are actor-start, page-audited, record-extracted, finding-emitted, and audit-report-generated. Dataset and report output is charge-gated. A zero-dollar cap emits no paid output.

Use Cases

• Verify an MTA-STS TXT record and policy version agree.
• Detect policy files that were observed as unreachable.
• Compare policy MX patterns with known inbound MX hosts.
• Identify testing-mode policies before enforcement rollout.
• Export domain-level rollout findings and evidence.

Limitations

The actor evaluates supplied DNS, HTTP, policy, and MX observations. It does not perform DNS or HTTP requests. Wildcard coverage follows MTA-STS-style suffix matching against the supplied host list.