MTA-STS & TLS-RPT generator.
Enforce encrypted delivery on your inbound mail. Enter your domain and MX hosts and get all three pieces — the _mta-sts record, the policy file, and the _smtp._tls TLS-RPT record — built live in your browser. No account, no card.
One per line — your exact MX hostnames (a wildcard like *.yourprovider.com is allowed). They must match the certificates your MX servers present.
How long receivers cache the policy. 604800 (1 week) is typical; start lower while testing.
Where daily TLS-RPT reports (JSON) are sent — how you'll see delivery failures.
v=STSv1; id=…Publish as a TXT record at _mta-sts.yourdomain.com.
version: STSv1
mode: testing
mx: mail.yourdomain.com
max_age: 604800Serve this over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt (valid certificate, content-type text/plain).
v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.comPublish as a TXT record at _smtp._tls.yourdomain.com.
Start in testing mode. Run mode: testing first and watch the TLS-RPT reports — only switch to enforce once they confirm every receiver reaches your MX over valid TLS, or you risk blocking your own inbound mail.
How to roll it out safely
MTA-STS protects mail coming to you; SPF, DKIM, and DMARC authenticate mail going out. The guide to MTA-STS and TLS-RPT covers the full rollout, and the domain health check confirms the records resolve once they're published.
- Publish all three, in testing mode
- Add the two TXT records, host the policy file over HTTPS at the mta-sts subdomain, and keep mode: testing so nothing is blocked yet.
- Watch TLS-RPT, then enforce
- Once the daily reports confirm every sender reaches your MX over valid TLS, switch to mode: enforce and bump the policy id.
Why enforce TLS on inbound mail
SMTP encryption is opportunistic by default, which means it can be silently stripped between servers. MTA-STS and TLS-RPT close that gap and give you visibility into delivery — a complement to the authentication that stops spoofing. Get SPF, DKIM, and DMARC right for outbound, and MTA-STS for inbound.
MTA-STS & TLS-RPT generator — FAQ
Secure the transport — then clean the list
MTA-STS protects delivery; verifying your list protects your reputation. Start free with 100 credits, no card required.