MTA-STS generator with MailAuth Doctor
The MTA-STS tab generates the three things you need: the policy file, the _mta-sts TXT record and a TLS-RPT record. It opens in testing mode.
- Enter your domain and the hostnames of your mail servers (your MX records).
- Generate the policy and publish it at https://mta-sts.<domain>/.well-known/mta-sts.txt.
- Publish the _mta-sts TXT record with an id and add the TLS-RPT record.
- Read the TLS reports in testing mode, then switch to enforce.
What to know
MTA-STS makes sending mail servers use TLS with a valid certificate when delivering to your domain, and refuse to fall back to plain text. It has two parts: a DNS TXT record at _mta-sts.<domain> that carries an id, and a policy file served over HTTPS from the host mta-sts.<domain> at /.well-known/mta-sts.txt.
The policy file lists the mode, the MX hostnames and a max_age in seconds. Start in testing mode, in which failures are only reported, and use a short max_age. The id in the DNS record must change whenever the policy changes, because senders cache the policy for max_age. TLS-RPT (the _smtp._tls TXT record) tells senders where to send daily reports about TLS failures, which is how you find a mail server with a bad certificate before you enforce.
The generator produces the text; it does not host the policy file. The HTTPS host needs a valid certificate and must serve the file exactly at that path. Any static hosting works, as long as it serves the file over HTTPS with a certificate valid for the mta-sts host name, and a typo in the path or a certificate mismatch is the most common reason a policy is silently ignored.
Updated · Cosmovex
Questions
How do I set up MTA-STS?
Publish a policy file at https://mta-sts.<yourdomain>/.well-known/mta-sts.txt, add a TXT record at _mta-sts.<yourdomain> with v=STSv1 and an id, and add a TLS-RPT record to receive reports.
What is the difference between testing and enforce mode?
In testing mode senders report TLS problems but still deliver. In enforce mode they refuse to deliver if TLS with a valid certificate cannot be established.
Why must the MTA-STS id change?
Senders cache the policy for max_age. A new id tells them to fetch the policy again.
Do you host the policy file?
No. The generator gives you the text; host it on any HTTPS static host at the required path.
The free plan covers everything on this page. MailAuth Doctor Pro ($7/mo, billed monthly) is described on the MailAuth Doctor page.
