Looking up MTA-STS DNS record, fetching policy file, and checking TLS-RPT...
Looking up MTA-STS DNS record, fetching policy file, and checking TLS-RPT...
MTA-STS + TLS-RPT for
Checked 5/14/2026, 10:52:42 PM · 505ms
No MTA-STS at all. Mail in transit is not enforced.
Or share this URL with the team that owns the records.
looked up: _mta-sts.berkeley.edu
https://mta-sts.berkeley.edu/.well-known/mta-sts.txt
No TLS-RPT record found. Without it, you do not learn when receivers fail to enforce STS against your domain.
for berkeley.edu
The id is an opaque string. Bump it whenever you change the policy file, otherwise receivers will keep using the cached version.
_mta-stsv=STSv1; id=20260514225243TLS-RPT lets receivers send you JSON reports when STS / DANE fails. Point the rua at a mailbox you actually monitor.
_smtp._tlsv=TLSRPTv1; rua=mailto:[email protected]Host the file below at https://mta-sts.berkeley.edu/.well-known/mta-sts.txt with a trusted TLS cert (no self-signed). Replace the mx: line(s) with each of your real mail servers. Start with mode: testing to collect TLS-RPT failure reports before raising to mode: enforce.
version: STSv1 mode: testing mx: mail.berkeley.edu max_age: 86400
Cloudflare Workers, Pages, or any static host with HTTPS can serve this. The well-known path needs a Content-Type of text/plain.
AI-assisted remediation
Wiredepth Pro sends this report to our AI engine and streams back a 30-day rollout plan tailored to berkeley.edu, with provider-specific tips when we can infer them from the data. 10 playbooks per month on Pro, 100 on MSP.