uCheckeruChecker

MTA-STS Generator

We produce both the TXT record and the policy file. Start in testing mode: with a wrong server list, enforce blocks inbound mail rather than merely complaining about it.

Policy mode

Start with testing: if the server list is wrong, enforce will block inbound mail. Switch over after a couple of weeks of reports.

Mail servers

List every MX host for the domain. Wildcards such as *.example.com are allowed. The list must match your actual MX records.

Policy lifetime, seconds

604800 is a week. Start smaller (86400) so a mistake can be rolled back quickly.

Generated record

v=STSv1; id=20260814160820
How to publish it
TypeNameTTL
TXT_mta-sts3600

Policy file

Serve this text at https://mta-sts.your-domain/.well-known/mta-sts.txt with a valid certificate and a text/plain content type.

version: STSv1
mode: testing
max_age: 86400

Change the id value every time you edit the policy file — that is how receivers know to re-read it.

What else this needs besides the record

  1. Stand up the mta-sts.yourdomain subdomain and get a certificate for it.
  2. Serve the policy file at /.well-known/mta-sts.txt with a text/plain content type.
  3. Publish the TXT record at _mta-sts.
  4. Set up TLS-RPT so you can see reports about failed connections.

The MX list has to match

Names in the policy are checked against the receiving server's certificate. If the file omits some of your MX records or lists stale names, enforce mode will stop some senders from delivering. Whenever you change mail provider, update the policy before you change the MX records.

Questions

Nearby

The channel is encrypted — check the list

MTA-STS secures the connection, not the addresses. uChecker verifies that the mailboxes you write to actually exist. The first 100 addresses are free.

Check your list