MTA-STS and TLS-RPT generator
Make sure email to your domain is always delivered over an encrypted connection. Enter your domain and we’ll build the MTA-STS policy and DNS records from your current mail servers.
Every server in your MX records must match a line. Wildcards match one level – for example, *.mail.protection.outlook.com.
Mail servers such as Google’s and Microsoft’s send daily JSON reports of connection problems here. Separate several addresses with commas.
1. Publish the policy file
Serve this file over HTTPS (with a valid certificate) at:
Point the host name at a web server – a CNAME to a static hosting service (GitHub Pages, Cloudflare Pages, Netlify and others) works well. The file must be served as text/plain, without redirects. On GitHub Pages, add a _config.yml containing include: [".well-known"], or the folder is ignored.
2. Add the DNS records
| Type | Name | Value |
|---|---|---|
| TXT | | |
| TXT | | |
Whenever you change the policy file, update the id in the _mta-sts record (any new value – we use the date and time), or senders keep using their cached copy until it expires.
3. Check it
Once published, check the policy and records with our DNS record checker. Leave the policy in testing mode for a few weeks, check the TLS reports for failures, then switch to enforce.
A free tool provided by Auth-Email
Auth-Email makes your Gmail, Outlook, or other OAuth 2.0 email account available to any IMAP, POP3, or SMTP email client — no app passwords or special configuration needed.
Frequently asked questions
What is MTA-STS?
MTA-STS lets your domain tell other mail servers to only deliver email to it over encrypted connections, to the mail servers you list. It stops attackers from downgrading or redirecting email in transit.
Where do I put the policy file?
It must be served over HTTPS, with a valid certificate, at https://mta-sts.yourdomain/.well-known/mta-sts.txt. Many people use a static hosting service such as GitHub Pages, Cloudflare Pages or Netlify.
Should I start with testing or enforce mode?
Start with testing mode and TLS-RPT reporting, so you can see any problems without affecting delivery. Switch to enforce once the reports show no failures.