MTA-STS Policy Generator
Free online MTA-STS policy generator. Includes testing-mode warnings and live validation. No signup required.
Loading tool...
What is MTA-STS Policy Generator?
An MTA-STS policy generator builds the two artifacts required by RFC 8461 (SMTP MTA Strict Transport Security): a DNS TXT record at _mta-sts.yourdomain.com carrying version STSv1, a policy id, and a mode, plus an HTTPS policy file served at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing the allowed MX patterns and a max_age cache lifetime. Together they tell sending mail servers to demand STARTTLS encryption and deliver only to your listed MX hosts, blocking downgrade and interception attacks.
Key Benefits
- Emits both deployment artifacts together so the DNS id always matches the policy file
- Prevents STARTTLS stripping and forged-MX interception once mode: enforce is active
- Testing mode lets you roll out gradually without risking legitimate mail delivery
- Live validation catches malformed domains, invalid MX patterns, and out-of-range max_age before you publish
Common Use Cases
- •Hardening business email domains against SMTP downgrade attacks
- •Complementing SPF, DKIM, and DMARC in a full email authentication stack
- •Adding or removing mail servers safely with id bumps and staged mode changes
- •Auditing existing MTA-STS deployments and regenerating policies after infrastructure changes
Generate an MTA-STS Policy
- Enter your domain and mode: Type your domain (the policy id auto-fills with a UTC timestamp) and choose a mode — start with testing to collect reports, then move to enforce once all MX hosts pass TLS checks.
- List your MX patterns: Enter one hostname pattern per line, such as .mail.example.com (a leading dot covers subdomains) or mail.example.com — invalid lines are flagged and shown as chips.
- Tune policy options: Set max_age in seconds (86400 is a good start, capped at 31557600) and keep the include-DNS-record checkbox on so the _mta-sts TXT record appears above the policy file.
- Deploy both halves: Copy the TXT record into DNS at _mta-sts.<domain>, serve the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt over HTTPS, or Download mta-sts-policy.txt with both bundled.
Key Features
- Generates both artifacts in one step: the v=STSv1 DNS TXT record and the .well-known/mta-sts.txt policy file
- All three RFC 8461 modes supported - enforce, testing, and none - with a testing-mode warning banner
- MX pattern list with live validation chips flagging hostnames missing a dot or containing invalid characters
- Auto-generated timestamp policy ids (YYYYMMDDHHMMSS) with manual override and 1-32 character validation
- max_age validated against the RFC cap of 31557600 seconds, with guidance on cache-refresh trade-offs
- One-click copy of each artifact, combined download, and the exact publish locations shown inline
Frequently Asked Questions
What two artifacts does MTA-STS deployment need?
A DNS TXT record at _mta-sts.domain containing v=STSv1; id=...; mode=..., and the policy file served over HTTPS at https://mta-sts.domain/.well-known/mta-sts.txt with the same id. The tool generates both and bundles them in one download.
Which mode should I choose: enforce, testing, or none?
Start with testing to collect failure reports without affecting delivery, then switch to enforce once every MX host presents valid TLS certificates; none turns the policy off. Whenever the policy changes, update the id in both places so senders re-fetch it.
What MX patterns should I list?
Every hostname pattern that may receive mail for the domain, one per line, such as .mail.example.com (a leading dot includes subdomains) or mail.example.com. In enforce mode, hosts not listed will fail the sending server TLS policy checks.
What does max_age control?
How long, in seconds up to 31557600, senders may cache your policy before re-fetching it — 86400 (one day) is a sensible start. Changing max_age has no effect until the DNS id changes too. Everything is generated in your browser.