Secure Your Mail in Transit: Audit MTA-STS and TLS-RPT
DMARC protects your brand name, but MTA-STS helps protect your mail while it's moving across the internet. Veldica audits your transport policy, security certificates, and TLS-RPT reporting in one go so you can enforce encrypted delivery with more confidence.
Use the free audit for a quick check or the Pro audit to see full details on your encryption and reporting status.
Overview
DMARC protects your brand name, but MTA-STS helps protect your mail while it's moving across the internet. Veldica audits your transport policy, security certificates, and TLS-RPT reporting in one go so you can enforce encrypted delivery with more confidence.
Teams who need to enforce encrypted inbound mail where possible and get notified if a secure connection fails.
Without MTA-STS, attackers can downgrade opportunistic TLS and increase the chance of unencrypted delivery. Veldica checks the rules that reduce that risk.
Verify that your security rules are active and reachable, and that your error reporting is set up correctly.
Encryption Setup Lifecycle
MTA-STS adds a layer of required encryption to your email. Veldica helps you set it up and keep it running.
- Audit: Send a domain to the API to check your current encryption status.
- Check: Verify your security rule file is online and using a valid certificate.
- Report: Make sure you have a reporting address to catch any delivery errors.
- Enforce: Move from "testing" to "enforce" mode once you know your mail is flowing safely.
- Maintain: Automate regular checks to catch expired certificates before they block your mail.
Hidden Encryption Risks
Transport security often breaks without warning, leading to lost mail or unencrypted data.
- Expired Certs: If your security certificate expires, other servers will stop sending you mail.
- Stuck in Testing: Many teams stay in "testing" mode forever and never get the real protection they need.
- No Reports: Without a reporting record, you will never know if people are having trouble sending you secure mail.
- Setup Mismatch: Your mail rules must match your server names. If they don't, mail delivery will fail.
Automated Transport Security
Move from manual checks to an automated encryption pipeline.
Try to check files and certificates by hand. Teams often miss specific technical errors.
Get a complete, structured report of your encryption and reporting status with one request.
Identify specific issues like 'invalid policy' or 'missing reports' in easy-to-use data.
Get concrete DNS and policy-file guidance to strengthen transport security.
Encryption & Report Audit
Use the Pro audit to check your mail encryption and report settings.
curl -H 'content-type: application/json' \
-H 'X-RapidAPI-Key: YOUR_RAPIDAPI_KEY' \
-H 'X-RapidAPI-Host: email-domain-trust-auditor.p.rapidapi.com' \
-X POST 'https://email-domain-trust-auditor.p.rapidapi.com/v1/pro/audits/domain' \
-d '{
"domain": "veldica.com"
}'Verified response
A report showing strong encryption but missing reports.
{
"domain": "veldica.com",
"score": 90,
"risk": {
"risk_level": "low",
"enforcement_status": "fully_enforced"
},
"findings": [
{
"id": "mta_sts.pass",
"check": "mta_sts",
"status": "pass",
"title": "MTA-STS Policy: Active",
"evidence": "Your mail is protected by required encryption."
},
{
"id": "tls_rpt.missing",
"check": "tls_rpt",
"status": "fail",
"severity": "medium",
"title": "Reporting Record Missing",
"fix": "Add a text record to receive reports when encryption fails."
}
]
}Exact steps to turn on your security reports.
{
"domain": "veldica.com",
"template_remediations": [
{
"issue_id": "tls_rpt.missing",
"priority": "p2",
"dns_name": "_smtp._tls.veldica.com",
"operation": "create",
"proposed_value_template": "v=TLSRPTv1; rua=mailto:reports@yourdomain.com",
"rationale": "Turn on reports so you can find and fix encryption errors."
}
]
}Reading the Results
Use the results to see how mature your mail security is.
- Check Status: Look for "pass" results to know your mail is being sent securely.
- Verify Rules: Look for "invalid policy" errors that mean your security file is broken or missing.
- Report Health: Make sure your reporting is active so you can debug any future issues.
- Risk Level: See how encryption adds to your overall domain security score.
Production Usage: Security Monitoring
How a security team uses the API to maintain transport encryption.
- Run a monthly check of all company domains to catch certificates that are about to expire.
- Check new company acquisitions to see if they have strong encryption enabled.
- Use fix-plans to help teams move out of "testing" mode and into full security.
- Add the audit to your DNS update steps to prevent security from being turned off by mistake.
- Create a leadership report showing which domains have enforced transport encryption.
import requests
def audit_encryption(domain):
url = "https://email-domain-trust-auditor.p.rapidapi.com/v1/pro/audits/domain"
headers = {"X-RapidAPI-Key": "YOUR_KEY"}
audit = requests.post(url, json={"domain": domain}, headers=headers).json()
issues = [f for f in audit['findings'] if f['status'] == 'fail']
for issue in issues:
print(f"Encryption risk on {domain}: {issue['title']}")Tool Comparison: Encryption Checks
Why Veldica is better for managing many domains.
Great for one domain, but they don't help you automate checks for your whole list.
Accurate but slow. You can't use them to monitor hundreds of domains every day.
Checks transport encryption alongside SPF, DKIM, DMARC, and related signals for a fuller score.
Keep Exploring
Use the Workflow Library to browse more guides, comparisons, and integration examples to continue your evaluation.
See the solutions, comparisons, and integration guides collected in one place.
Review grounded audit, compare, fix-plan, and report excerpts before you wire the API into anything.
Jump from the workflow page into the quickstart, endpoint guides, and full OpenAPI reference.
Turn on secure mail delivery
Don't leave transport security to chance. Use the Veldica API to check your rules and strengthen encrypted mail delivery.