Check MTA-STS transport security policy and BIMI brand indicator record for any domain - both in one lookup.
Enter a domain to check MTA-STS and BIMI configuration
MTA-STS (Mail Transfer Agent Strict Transport Security) forces sending mail servers to use TLS when delivering to your domain, refusing delivery if TLS is unavailable. It requires a policy file at https://mta-sts.{domain}/.well-known/mta-sts.txt and a DNS TXT record at _mta-sts.{domain}. Use mode=enforce in production and pair it with TLS-RPT to receive delivery failure reports.
BIMI (Brand Indicators for Message Identification) lets email senders display a verified brand logo next to messages in clients like Gmail and Apple Mail. It requires a DMARC policy of p=quarantine or p=reject and a TXT record at default._bimi.{domain}. The a= VMC certificate field is required by Gmail to show the verified blue checkmark.
Sent to our server: Domain. We look it up in DNS. We fetch files from that site. Part of this work runs on our own server. Your browser loads the pictures the site points to, which may be hosted elsewhere. To answer a repeated check fast, we have to keep answers for 1 hour; then they are deleted. Also added to the page link, so you can share the result: Domain.