MTA-STS

MTA-STS (RFC 8461) lets a mail domain require encrypted, certificate-verified SMTP delivery. It consists of two parts: a TXT record at _mta-sts.<domain> and a policy file served over HTTPS – this generator produces both.

Host the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt with Content-Type: text/plain, without any redirects and with a valid certificate for mta-sts.<domain>. When changing the policy, update the file first and only then change the id in the TXT record – senders re-fetch the policy only when the id changes.

Domain

Mode

Starting with testing is fine; the security check rates only enforce as a pass.

MX hosts (one per line)

A *. wildcard covers exactly one label: *.example.com matches mx.example.com but not example.com.

max_age (seconds)

Default 1209600 (two weeks). For enforce and testing, RFC 8461 §3.2 expects “weeks or greater”, §10.2 asks for values “as long as is practical”, and 31557600 (~1 year) is the hard maximum — so 604800–31557600 is the sensible band. For mode: none the opposite applies: RFC 8461 §8.3 asks for “a small max_age (e.g., one day)” so senders drop the retired policy quickly; only once all previously served policies have expired may the TXT record and the HTTPS endpoint be removed.

Records are built in your browser; “Load current record” has our server look up DNS and fetch the published policy file. Record Studio · Verify the result with the domain security check