Updated · Volt Ghost team
All 14, by service
| Service (MX host) | Domains with the TXT record | Policy file on 9 Nov 2026 |
|---|---|---|
YOPmail (smtp.yopmail.com) | 3 | All 3 load: mode: enforce, max_age 1 day |
Burner Mail (mail.burnermail.io) | 1 | Loads: enforce, 1 day |
Own mail. host on the domain | 2 | Both load: enforce, 7 and 30 days |
Own mail. host on the domain | 1 | Loads: mode: testing, 1 day |
Forge relay (receive.forge.rmta.net) | 1 | Loads: testing, 7 days |
GPTMail (email.gravityengine.cc) | 2 | Fail: TLS connection closed during handshake |
Own mail. host on the domain | 1 | Fail: TLS connection closed during handshake |
TEMPMAIL.TW (tempmail.tw) | 1 | Fail: TLS internal error |
| Shared host on another domain | 1 | Fail: certificate does not match the name |
| Google Workspace MX | 1 | Fail: HTTP 403 |
We name services rather than every domain, and the lookup below checks one name at a time. Six working enforce policies across a list of nearly ten thousand domains is the headline: YOPmail's three domains (yopmail.com, .fr and .net) account for half of them.
Why a TXT record is not enough
The _mta-sts TXT record only announces that a policy exists and gives it an ID. The policy itself must be served at https://mta-sts.<domain>/.well-known/mta-sts.txt with a certificate valid for that host name. Six of the fourteen fail that step: three close the TLS connection mid-handshake, one returns a TLS internal error, one presents a certificate for a different name and one answers 403 Forbidden. A sender that follows RFC 8461 and has no cached copy treats those domains as if they had no policy. Two of the failures belong to the GPTMail pool, whose other 1,023 domains publish no MTA-STS at all.
TLS reporting
MTA-STS usually comes with TLS-RPT (RFC 8460), a TXT record at _smtp._tls that asks senders to report failed encrypted deliveries. 8 of the 6,723 listed domains with MX publish one. Without it, a domain in testing mode learns nothing from its test.
How real providers compare
Large mailbox providers publish both parts and keep them working; the GMX MX records page shows a live MTA-STS policy, and the Gmail, Proton and Fastmail pages in the same series cover it as well. The gap matters less for temp mail than it sounds: the code you are waiting for usually travels over TLS anyway, because most large senders try STARTTLS by default. MTA-STS only stops an attacker from downgrading that connection.
Choosing a throwaway inbox
None of this changes the basic rule for temporary addresses: assume the inbox is not private. If you are comparing services, our best temp mail services page looks at how long each keeps mail and whether inboxes are public, and the burner email page covers when a short-lived address is the right tool. For the records behind sending rather than receiving, see DMARC and SPF on disposable domains.
Check one domain
Type one domain to see whether it is on the disposable list or which mail servers it uses. The checker answers one name at a time.
Questions
Do disposable email services use MTA-STS?
Almost never. Only 14 of 6,723 listed domains with a working MX record published the MTA-STS TXT record on 9 November 2026, and only 8 of those served a policy file a sender could load.
What happens if the MTA-STS policy file cannot be fetched?
RFC 8461 says a sender that has no cached policy and cannot fetch one should deliver as if the domain had no MTA-STS. The TXT record alone does nothing.
What is the difference between enforce and testing mode?
In enforce mode a sender must refuse to deliver if it cannot connect to a listed MX host over valid TLS. In testing mode it delivers anyway and only reports the failure, if the domain also publishes TLS reporting.
Is a temp mail service with MTA-STS safer to use?
It protects mail in transit to the service, not what happens after. Most temp inboxes are public or short-lived, so treat everything sent there as readable by others.
