Skip to content
Start with 100 free verification credits
Qualisend
Free tool

MTA-STS & TLS-RPT generator.

Enforce encrypted delivery on your inbound mail. Enter your domain and MX hosts and get all three pieces (the _mta-sts record, the policy file, and the _smtp._tls TLS-RPT record) built live in your browser. No account, no card.

One per line: your exact MX hostnames (a wildcard like *.yourprovider.com is allowed). They must match the certificates your MX servers present.

How long receivers cache the policy. 604800 (1 week) is typical; start lower while testing.

Where daily TLS-RPT reports (JSON) are sent - how you'll see delivery failures.

1. MTA-STS DNS record (TXT)
v=STSv1; id=…

Publish as a TXT record at _mta-sts.yourdomain.com.

2. Policy file
version: STSv1 mode: testing mx: mail.yourdomain.com max_age: 604800

Serve this over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt (valid certificate, content-type text/plain).

3. TLS-RPT DNS record (TXT)
v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com

Publish as a TXT record at _smtp._tls.yourdomain.com.

Start in testing mode. Run mode: testing first and watch the TLS-RPT reports - only switch to enforce once they confirm every receiver reaches your MX over valid TLS, or you risk blocking your own inbound mail.

How to roll it out safely

MTA-STS protects mail coming to you; SPF, DKIM, and DMARC authenticate mail going out. The guide to MTA-STS and TLS-RPT covers the full rollout, and the domain health check confirms the records resolve once they're published.

Publish all three, in testing mode
Add the two TXT records, host the policy file over HTTPS at the mta-sts subdomain, and keep mode: testing so nothing is blocked yet.
Watch TLS-RPT, then enforce
Once the daily reports confirm every sender reaches your MX over valid TLS, switch to mode: enforce and bump the policy id.

Why enforce TLS on inbound mail

SMTP encryption is opportunistic by default, which means it can be silently stripped between servers. MTA-STS and TLS-RPT close that gap and give you visibility into delivery - a complement to the authentication that stops spoofing. Get SPF, DKIM, and DMARC right for outbound, and MTA-STS for inbound.

MTA-STS & TLS-RPT generator FAQ

MTA-STS (SMTP MTA Strict Transport Security, RFC 8461) lets your domain tell sending servers that inbound mail must be delivered over TLS to your authenticated MX hosts. Without it, SMTP encryption is opportunistic and can be stripped by an attacker in the middle; MTA-STS closes that downgrade gap. It's a DNS TXT record that points to a policy file served over HTTPS.

In testing mode, receivers that support MTA-STS still deliver mail even if your policy check fails, but they report the failure via TLS-RPT - so you see problems without risking delivery. In enforce mode, a receiver refuses to deliver to an MX that doesn't match the policy or presents an invalid certificate. Always start in testing, confirm the reports are clean, then move to enforce.

TLS-RPT (RFC 8460) is the companion record at _smtp._tls.yourdomain. It asks receiving servers to send you a daily JSON report of TLS handshake successes and failures when they deliver to your MX. Those reports are how you confirm every sender can reach you over valid TLS before you switch MTA-STS to enforce - and how you catch certificate problems afterward.

Three things, all generated here: (1) a TXT record at _mta-sts.yourdomain containing v=STSv1 and an id you increment whenever the policy changes; (2) the policy file itself, served over HTTPS at https://mta-sts.yourdomain/.well-known/mta-sts.txt with a valid certificate; and (3) the TLS-RPT TXT record at _smtp._tls.yourdomain. The DNS records alone aren't enough - the policy file must be reachable over HTTPS.

Both enforce TLS for inbound SMTP, but they differ in trust anchor. DANE publishes TLSA records secured by DNSSEC; MTA-STS uses an HTTPS-hosted policy plus DNS and does not require DNSSEC, which makes it easier to deploy for most domains. Gmail, Outlook, and Yahoo all honor MTA-STS, so it's the more widely-supported option today.

Secure the transport - then clean the list

MTA-STS protects delivery; verifying your list protects your reputation. Start free with 100 credits, no card required.

Start verifying