Checks an MTA-STS deployment end to end: the _mta-sts TXT record (v=STSv1, id), the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt (version, mode, mx patterns with wildcard matching, max_age, redirects and content type per RFC 8461), coverage of the domain's real MX hosts by the policy, and the TLS-RPT record at _smtp._tls (v=TLSRPTv1, rua). Browsers can only read the policy when the mta-sts host allows cross-origin reads; when it does not, the report says so and gives the curl command. Recommendations cover rollout from testing to enforce. Names are sent to the chosen resolver; nothing is stored.