MTA-STS generator: policy file, _mta-sts record and TLS-RPT record
An MTA-STS generator writes the three pieces MTA-STS needs: the mta-sts.txt policy file listing your MX hosts, the _mta-sts TXT record with a policy id, and a TLS-RPT record for failure reports. Enter your domain, fill in your MX hosts, choose testing mode, and copy each piece to your web host and DNS.
Everything is built in your browser. Only Fill from my MX records sends the domain to our server, for one DNS lookup.
Sample result
Your MTA-STS policy for acme.example is ready to publish in testing mode.
- Policy mode
- testing
- Policy file
- mta-sts.txt
- TXT records
- _mta-sts and _smtp._tls
What this means for you
It asks other servers to send you mail over encrypted connections. Publish, then check it.
- Policy file, _mta-sts record and TLS-RPT
- Pulls your MX hosts from live DNS
- Testing, enforce or none modes
- Checks mx patterns, id and max_age limits
- MTA-STS
- TLS-RPT
- Generator
By SimpleVerifier Team · Last updated
How do I set up MTA-STS?
- Enter the domain that receives mail, such as yourdomain.com.
- Press Fill from my MX records, or pick a preset for Google Workspace or Microsoft 365, so every MX host has an mx line.
- Keep testing mode and a one or two week max_age to start, and add a mailbox or report service for TLS-RPT reports.
- Download mta-sts.txt, serve it at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt and publish the two TXT records. Then run the MTA-STS checker, and after two weeks of clean reports switch to enforce and change the policy id.
Example
- You enter
- The domain
acme.example, with its MX hosts filled from DNS (aspmx.l.google.com) and testing mode kept. - You get
- A policy file for
https://mta-sts.acme.example/.well-known/mta-sts.txtwithmode: testing, the mx lines andmax_age: 604800, plus the_mta-sts.acme.exampleTXT record with a new id and a_smtp._tlsTLS-RPT record. - Limits
- Built in your browser. Fill from my MX records is one DNS lookup, 10 a minute per connection; you host the file yourself.
What is an MTA-STS policy file?
It is a plain text file that tells sending mail servers to deliver to your domain only over TLS, and only to the MX hosts it lists. RFC 8461 defines four fields: version: STSv1 on the first line, mode (testing, enforce or none), one mx line per mail server, and max_age, the number of seconds senders may cache the policy, at most 31,557,600 (about a year).
The file must be served over HTTPS with a valid certificate at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, as text/plain, with an HTTP 200 and no redirect: RFC 8461 tells senders not to follow redirects when fetching it. Google's MTA-STS guide adds that the file can be up to 64 KB and that max_age should be between 86,400 (one day) and 31,557,600.
How do I create an MTA-STS DNS record?
Add a TXT record at _mta-sts.yourdomain.com with the value v=STSv1; id=20261017120000. The record says a policy exists; the id is 1 to 32 letters and digits that you change every time the policy file changes, so senders know to fetch it again. The generator uses the current date and time, which always sorts newer.
You also need an A or CNAME record for the mta-sts subdomain pointing at wherever the policy file is hosted, with a certificate that covers mta-sts.yourdomain.com. Any static host that serves HTTPS on that name works.
Which mx lines does my MTA-STS policy need?
One for every MX record of the domain, or a pattern that covers it. An mx value is a host name, or *. followed by a domain, where the * stands for exactly one leftmost label: *.example.net matches mx1.example.net but not example.net or a.b.example.net. In enforce mode, a sender won't deliver to an MX host the policy doesn't cover, which is why Fill from my MX records reads them from DNS and flags any that no line matches.
For Microsoft 365, Microsoft's MTA-STS guide gives mx: *.mail.protection.outlook.com, and says that wildcard is specific to Exchange Online. Google Workspace domains point at smtp.google.com on newer setups and at aspmx.l.google.com with alt1 to alt4 backups on older ones, so the presets cover both. If you're unsure, use your real MX hosts from the MX lookup.
What is a TLS-RPT record, and do I need one with MTA-STS?
A TLS-RPT record is a TXT record at _smtp._tls.yourdomain.com that tells senders where to send daily reports on TLS failures, defined in RFC 8460: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com. It isn't required for MTA-STS to work, but without it testing mode tells you nothing, so the generator builds it alongside the policy. Several destinations go in one rua=, separated by commas; https: endpoints are allowed.
The record is a single line, so it doesn't need its own generator: add your addresses above and copy record 3. To check a published one, including whether each destination can receive reports, use the TLS-RPT checker.
Why does it say my MTA-STS policy is missing or the fetch failed?
Usually because the file isn't reachable exactly where senders look: a missing mta-sts DNS name, a certificate that doesn't cover it, a redirect from http or to another path, or a wrong content type. A _mta-sts TXT record without a reachable policy file means senders treat the domain as having no valid policy. The MTA-STS checker fetches the file the way a sender does and names the failing step.
MTA-STS testing vs enforce vs none
| testing | enforce | none | |
|---|---|---|---|
| TLS fails or MX not listed | Deliver, then report | Don't deliver | No policy applies |
| mx lines needed | Yes | Yes | No |
| Suggested max_age | 1-2 weeks | Weeks to a year | Keep the old value until caches expire |
| When to use it | First weeks, reading TLS-RPT | Once reports are clean | To withdraw MTA-STS |
Who uses this tool, and for what?
- IT admins
- Write a first MTA-STS policy that covers every MX host, in testing mode, with reports going to a mailbox the team reads.
- MSPs and agencies
- Produce the file and both TXT records for a client domain in one go, ready to paste into their host and DNS panel.
- Email migrations
- Regenerate the policy with the new provider's MX hosts and a new id, so senders refetch it before enforce mode blocks mail.
- Security reviews
- Close the STARTTLS downgrade gap flagged in an audit, starting in testing mode so nothing is blocked by mistake.
What can’t this tool tell you?
- It writes the policy; it can't host it. You still need HTTPS with a valid certificate on mta-sts.yourdomain.com.
- It checks syntax and MX coverage, not whether your MX hosts present valid TLS certificates. TLS-RPT reports tell you that.
- The MX presets are the providers' published host names; your domain's own MX records are the authority, so prefer Fill from my MX records.
- Senders cache the old policy for its max_age, so changes reach them only after they refetch, which a new id prompts.
Common questions
- What is an MTA-STS policy?
- A text file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with version, mode, mx and max_age lines. It tells senders to require TLS and lists the MX hosts they may deliver to.
- What is MTA-STS?
- SMTP MTA Strict Transport Security (RFC 8461): a TXT record at _mta-sts.yourdomain.com plus an HTTPS-hosted policy file that tell other mail servers to deliver to you only over TLS, to the MX hosts you list.
- What is the MTA-STS policy mode?
- Start with testing: senders still deliver when TLS fails and report the failure through TLS-RPT. Google suggests about two weeks of reports before switching to enforce. Use none only to withdraw a policy.
- What is a TLS-RPT record?
- A TXT record at _smtp._tls.yourdomain.com, such as v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com, that tells senders where to send daily TLS failure reports.
- Why does it say the MTA-STS policy is missing?
- Either there is no TXT record at _mta-sts.yourdomain.com, or the policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt can't be fetched over HTTPS with a 200 and no redirect. Publish both, then run the MTA-STS checker.
- How long should max_age be?
- One to two weeks (604800 to 1209600 seconds) while testing, as Google recommends, then longer once enforced. RFC 8461 caps it at 31557600 seconds.
- Does the mta-sts.txt file need CRLF line endings?
- No. RFC 8461's grammar accepts LF or CRLF at the end of each line. Its text describes the fields as CRLF-separated, so the download uses CRLF; either works.
Sources
Authentication and capacity are half of deliverability.
The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.