domainsecuritycheck

← Record Studio

MTA-STS

MTA-STS (RFC 8461) lets a mail domain require encrypted, certificate-verified SMTP delivery. It consists of two parts: a TXT record at _mta-sts.<domain> and a policy file served over HTTPS – this generator produces both.

Host the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt with Content-Type: text/plain, without any redirects and with a valid certificate for mta-sts.<domain>. When changing the policy, update the file first and only then change the id in the TXT record – senders re-fetch the policy only when the id changes.

Starting with testing is fine; the security check rates only enforce as a pass.

A *. wildcard covers exactly one label: *.example.com matches mx.example.com but not example.com.

Default 1209600 (two weeks); recommended range 604800–31557600.

Runs entirely in your browser. Record Studio · Verify the result with the domain security check