MTA-STS Policy Generator
Generate an MTA-STS policy file, the _mta-sts TXT record with a policy id and a TLS-RPT record, so senders require TLS when delivering to your mail servers.
Free · No sign-up · Your inputs stay in your browser
Input
Generate an MTA-STS policy and TLS-RPT record
Output
Three things to publish
https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1 mode: testing mx: aspmx.l.google.com mx: *.aspmx.l.google.com max_age: 604800
Served as text/plain.
TXT _mta-sts.example.com
v=STSv1; id=20261027T000000
TXT _smtp._tls.example.com
v=TLSRPTv1; rua=mailto:[email protected]
Daily JSON reports of TLS failures from senders such as Google and Microsoft (RFC 8460).
MTA-STS (RFC 8461) tells sending servers to require valid TLS when delivering to your MX, which stops a network attacker from stripping STARTTLS. The policy file must be served over HTTPS with a valid certificate from the mta-sts subdomain. Change the id in the TXT record every time the policy changes, or senders keep the cached one until max_age runs out.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What it protects
SMTP between servers uses STARTTLS opportunistically: an attacker on the path can strip the STARTTLS offer and read mail in clear. MTA-STS (RFC 8461) lets a domain say that its MX hosts always support valid TLS, and compliant senders such as Gmail and Microsoft then refuse to deliver without it.
Testing first
Run in testing mode with TLS-RPT (RFC 8460) reports for a couple of weeks, check that no sender reports failures, then switch to enforce. Change the id every time the policy file changes, or senders keep the cached policy until max_age expires.