MTA-STS Generator
We produce both the TXT record and the policy file. Start in testing mode: with a wrong server list, enforce blocks inbound mail rather than merely complaining about it.
Start with testing: if the server list is wrong, enforce will block inbound mail. Switch over after a couple of weeks of reports.
List every MX host for the domain. Wildcards such as *.example.com are allowed. The list must match your actual MX records.
604800 is a week. Start smaller (86400) so a mistake can be rolled back quickly.
Generated record
v=STSv1; id=20260814160820| Type | Name | TTL |
|---|---|---|
| TXT | _mta-sts | 3600 |
Policy file
Serve this text at https://mta-sts.your-domain/.well-known/mta-sts.txt with a valid certificate and a text/plain content type.
version: STSv1
mode: testing
max_age: 86400Change the id value every time you edit the policy file — that is how receivers know to re-read it.
What else this needs besides the record
- Stand up the
mta-sts.yourdomainsubdomain and get a certificate for it. - Serve the policy file at
/.well-known/mta-sts.txtwith atext/plaincontent type. - Publish the TXT record at
_mta-sts. - Set up TLS-RPT so you can see reports about failed connections.
The MX list has to match
Names in the policy are checked against the receiving server's certificate. If the file omits some of your MX records or lists stale names, enforce mode will stop some senders from delivering. Whenever you change mail provider, update the policy before you change the MX records.
Questions
Nearby
The channel is encrypted — check the list
MTA-STS secures the connection, not the addresses. uChecker verifies that the mailboxes you write to actually exist. The first 100 addresses are free.
Check your list