Check your site

Which countries’ laws

We check against the laws of all five markets. You can pick several at once, say the EU and the US if you ship between them or sell to customers in both.

Domain email

CAA and MTA-STS: DNS records against forged certificates and mail interception

CAA says who may issue certificates for your domain. MTA-STS forces encrypted mail delivery. How to add both records without breaking email.

Checked against sources: 11 October 2026

  • RFC 8659the CAA record standard
  • RFC 8461the MTA-STS standard
  • 2 weeksin testing mode before enforce

CAA: who may issue a certificate

Certificate authorities check the CAA record before issuing. If only your authority is named, no other will issue a forged certificate for your domain.

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild "letsencrypt.org"

MTA-STS: mail over an encrypted channel only

Without MTA-STS a sender’s mail server may fall back to plain text when encryption fails, and the message can be intercepted. MTA-STS is a TXT record plus a policy file on the mta-sts subdomain.

_mta-sts.example.com.  TXT  "v=STSv1; id=20261001"

# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: mx.example.com
max_age: 86400

How not to break mail

Start with mode: testing and switch to enforce after two error-free weeks. Before enabling CAA make sure every authority that issues for your subdomains is named, otherwise renewal stops. The SPF, DMARC, CAA and MTA-STS generator builds both records.

Frequently asked

Do I need MTA-STS with Google Workspace or Microsoft 365?

Yes, if you want customer mail delivered over an encrypted channel. The services support MTA-STS, you only publish the record and the policy.

What happens if CAA is wrong?

The authority refuses to issue or renew the certificate and the site becomes unreachable over HTTPS. Test renewal after any change.

How does it differ from DANE?

DANE solves a similar problem through DNSSEC. MTA-STS is simpler: it works without DNSSEC and big mail providers support it.

Sources

Check your site

Awe Check shows in a minute which of this is broken on your site and calculates the possible fine.

Check a site
Awe Check Pro

Watch your site and competitors

Pro checks the site on its own, compares it with competitors and tells you when the score drops or SSL and the domain are about to expire.

  • Watch your own sites and competitors
  • Site battles: where you lag and where you lead
  • Domain and SSL expiry in advance
  • Telegram and email alerts
Payment is not connected yet. Press it and we will tell you first when it launches. Nothing is charged.
Compare with a competitorWhat Pro includes →