Check a domain
Reads the _mta-sts and _smtp._tls TXT records and the MX hosts through Google DNS over HTTPS.
Enter a domain and click "Check MTA-STS".
MTA-STS (RFC 8461) lets a domain require TLS with a valid certificate for its mail servers; TLS-RPT (RFC 8460) sends it reports when that fails.
Check the policy file
The policy lives at https://mta-sts.<domain>/.well-known/mta-sts.txt. This page cannot fetch it: browsers only allow that cross-origin request if the policy server sends CORS headers, and almost none do (tested: gmail.com, outlook.com, yahoo.com and fastmail.com are blocked, only a few such as proton.me answer). So fetch it yourself and paste it here.
or open in a browser tab and copy the text. A policy served with a redirect or a bad certificate is already a failure: senders will not use it.
Run a lookup above to get the curl command for the domain.
Policy and record generator
Builds the policy file and the two TXT records for the domain in the box above. Start in testing, watch the TLS-RPT reports, then switch to enforce and change the id.
*.host matches exactly one label below host