MTA-STS generator

Protect mail delivery to your domain with MTA-STS: choose a mode, add your MX hosts, copy the DNS record and policy file.

MTA-STS makes sure mail to your domain is only delivered over encrypted connections. Start in testing mode and watch the reports.

Your domain (optional)used for the host names and the policy URLMode

Problems are only reported (via TLS-RPT), delivery is not affected.

MX hosts of your domain (comma-separated)Exactly the host names from your MX records; wildcards like *.example.com are allowed.Validity period (max_age)How long receivers may cache the policy.TLS report address (TLS-RPT, optional)Receivers send you daily reports about TLS problems during delivery.

Your MTA-STS setup

1. Host the policy file (mta-sts.txt)

version: STSv1
mode: testing
max_age: 604800

The file must be reachable over HTTPS (with a valid certificate) at: https://mta-sts.<domain>/.well-known/mta-sts.txt

Tip: with regfish email hosting the policy file is hosted automatically at the right address: learn more →

2. Publish the DNS record (the switch)

Host / name_mta-stsTypeTXT

v=STSv1; id=202607151820

The id is a timestamp of this page view. Every change to the policy file requires a new id.

No MX hosts given: without mx lines the policy is incomplete and receivers ignore it.

At regfish the assistant creates this record for you in one click: sign up for free →