Privacy controls
CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.
Validate your MTA-STS (Mail Transfer Agent Strict Transport Security) policy to ensure SMTP connections are always encrypted and prevent downgrade attacks.
MTA-STS (Mail Transfer Agent Strict Transport Security) is an email security protocol that enforces TLS encryption for all SMTP connections to your domain. It prevents man-in-the-middle downgrade attacks that strip TLS, forcing sending mail servers to use encrypted channels or fail delivery.
Without MTA-STS, an attacker can silently downgrade SMTP connections to plaintext, exposing email content. MTA-STS prevents this by requiring TLS for all inbound connections.
Publishing MTA-STS without a matching DNS TXT record, using mode=testing forever without progressing to enforce, and not updating the id when changing policy are common errors.
Type your domain into the MTA-STS checker.
We verify the DNS TXT record at _mta-sts.yourdomain.
We retrieve the policy file from https://mta-sts.yourdomain/.well-known/mta-sts.txt.
We check mode, max_age, and MX host list for correctness.
Verifies the DNS TXT record at _mta-sts is present and correctly formatted with v=STSv1 and a unique id for cache busting.
Fetches the MTA-STS policy file from the well-known URL over HTTPS. Validates the file is accessible and properly formatted.
Checks whether the policy mode is enforce, testing, or none. Enforce is required for full protection against downgrade attacks.
Lists all authorized MX hosts in the policy file. Ensures only your legitimate mail servers are trusted for encrypted delivery.
Validates the max_age value. Longer values reduce policy refresh frequency but delay updates. Shorter values increase agility.
Confirms the policy file is served over HTTPS. HTTP-only delivery is invalid per RFC 8461 and is flagged as a critical error.
Automate MTA-STS, DMARC, SPF, and DKIM checks. Get alerted when policies drift, expire, or break across all your email domains.