MTA-STS Policy Generator - Policy File, DNS Record and TLS-RPT
MTA-STS Policy Generator
Make sure mail servers send email to your domain over verified TLS
Three Files, One Tool
Get the _mta-sts TXT record, the mta-sts.txt policy file and, optionally, the _smtp._tls record that asks senders to report TLS failures.
Testing Mode First
Start in testing mode so problems are reported without losing mail, then switch to enforce when the reports are clean.
Checks Your Input
MX host names, wildcards, max_age limits and the id format are validated against RFC 8461 as you type.
Private
Everything is generated in your browser. No domain name is sent to a server.
Why MTA-STS Matters
Email between servers uses opportunistic encryption: if a sending server cannot negotiate TLS, it usually falls back to plain text, and an attacker on the network can force that fallback or present a fake certificate. MTA-STS lets your domain publish a policy that says which mail servers are valid, that they must support TLS with a certificate that checks out, and for how long senders should remember that.
It has two parts. A DNS TXT record at _mta-sts.yourdomain.com announces that a policy exists and carries an id that you change whenever the policy changes. The policy itself is a small text file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, so you need that host name to have a valid certificate. TLS-RPT is a separate record where senders can report delivery problems, which is how you learn whether enforce mode is safe.
Key Takeaways
- Follows the RFC: The policy format, limits and examples come from RFC 8461 (MTA-STS) and RFC 8460 (TLS-RPT).
- Change the id with the policy: Senders cache the policy and only fetch it again when the id in DNS changes.
- Related tools: See also the SPF Record Generator, the DMARC Record Generator and the DKIM record generator for the rest of your email security.