Email authentication

MTA-STS Policy Generator

Generate the MTA-STS DNS record and .well-known policy file to enforce TLS on inbound email. Free MTA-STS generator with enforce, testing and none modes.

Configure MTA-STS

Set your mode and MX hosts. You'll publish one DNS record and one policy file.

1. DNS TXT record

TXT
Type
enforce
Mode
…
Policy id

Host

_mta-sts.yourdomain.com

Value

v=STSv1; id=00000000000000

2. Policy file

Host at this exact URL:

https://mta-sts.yourdomain.com/.well-known/mta-sts.txt

File contents

version: STSv1
mode: enforce
mx: mail.yourdomain.com
max_age: 604800
Start in testing mode first. Only switch to enforce after TLS-RPT reports confirm all your mail servers support TLS — enforce can block delivery otherwise.

What this MTA-STS generator does

Builds the _mta-sts DNS TXT record with a fresh policy id
Generates the .well-known/mta-sts.txt policy file
Supports enforce, testing and none modes
Lists your MX hosts and sets max_age
Shows the exact HTTPS URL to host the policy at
One-click copy for every value

Common use cases

  1. 1Enforcing TLS on inbound mail to stop downgrade attacks
  2. 2Rolling out MTA-STS safely in testing mode first
  3. 3Updating your policy after changing MX records
  4. 4Meeting security requirements for email in transit
  5. 5Publishing MTA-STS alongside TLS-RPT reporting
  6. 6Rotating the policy id after a policy change

Related tools

TLS-RPT generatorEmail Authentication AnalyzerDMARC generatorSPF generatorDKIM key generatorDMARC Record Checker

About MTA-STS

MTA-STS (SMTP MTA Strict Transport Security) tells sending servers to require TLS when delivering to your domain, preventing downgrade and man-in-the-middle attacks. It needs two parts: a DNS TXT record at _mta-sts.yourdomain.com and a policy file served over HTTPS at mta-sts.yourdomain.com/.well-known/mta-sts.txt.

Deploy in testing mode first and pair it with TLS-RPT so you receive reports. Once reports confirm every mail server negotiates TLS correctly, switch to enforce. Bump the policy id whenever you change the file.

More Free Tools Where This Came From

This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.

See All ToolsTalk to Our Team

HostCloud.in  ·  Pune, India  ·  Serving 34,987+ Websites Since 2020

FREQUENTLY ASKED QUESTIONS

Got Questions? We Have Answers.

What is MTA-STS?

MTA-STS (SMTP MTA Strict Transport Security) tells sending servers to require TLS when delivering to your domain, blocking downgrade and man-in-the-middle attacks.

What do I need to publish?

Two things: a DNS TXT record at _mta-sts.yourdomain.com, and a policy file served over HTTPS at mta-sts.yourdomain.com/.well-known/mta-sts.txt.

What is the difference between the modes?

enforce requires TLS (mail is rejected if it fails), testing reports failures without blocking, and none disables the policy. Start with testing.

What is the policy id for?

The id is a version string in the DNS record. Change it whenever you update the policy file so senders know to re-fetch it.

Why start in testing mode?

enforce can block delivery if any of your mail servers lack proper TLS. Testing plus TLS-RPT lets you confirm everything works before enforcing.

How does this relate to TLS-RPT?

TLS-RPT gives you reports on TLS successes and failures. Publish it alongside MTA-STS so you can monitor the rollout before enforcing.