emailsecops
Menu
All tools

MTA-STS record generator

Builds the _mta-sts TXT record, the policy file from your live MX hosts and the TLS-RPT record, exactly as published, and shows what changes against what you serve today.

604800 is one week, 86400 one day, 31557600 the maximum. Your MX hosts are looked up live.

How MTA-STS is deployed

MTA-STS (RFC 8461) has two parts: a TXT record at _mta-sts.yourdomain whose id tells senders when the policy changed, and a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt that lists the MX hosts allowed to receive your mail. Senders that support it, Gmail and Microsoft 365 among them, cache the policy for max_age seconds and, in enforce mode, deliver only over TLS with a valid certificate to a listed host. TLS-RPT (RFC 8460) adds daily reports of the TLS connections senders made to you and the failures they met. Check the result with the MTA-STS checker.

Testing first, then enforce

Publish the policy in mode: testing with a TLS-RPT address and read the reports for a week or two. In testing mode nothing changes for delivery; the reports show which senders could not set up valid TLS to your MX hosts. When they are clean, switch to mode: enforce and change the id. Change the id whenever you edit the policy, and add new MX hosts to it before you switch MX records.

MTA-STS record generator: questions

Can I host the MTA-STS policy file on a static site or CDN?+
Yes. Any HTTPS host works if it serves the file at https://mta-sts.example.com/.well-known/mta-sts.txt as text/plain, with a valid certificate for that name, an HTTP 200 response and no redirect. Point the mta-sts subdomain at the host, upload the generated policy, check that the URL loads, and only then publish the TXT record.
What is the id in the MTA-STS TXT record?+
A version label for your policy: 1 to 32 letters and digits that senders compare with the id of the policy they cached (RFC 8461 §3.1). Change it every time you edit the policy file, or senders keep using their cached copy. The generator uses the current UTC date and time, such as 20261013120000, so every change gets a new id.
How long does an MTA-STS policy stay cached?+
For max_age seconds, a value set in the policy file. Senders keep applying a cached policy for that long and fetch a new one when they see a new id in the TXT record. RFC 8461 allows up to 31557600 seconds (about a year); the generator defaults to 604800 (one week) and accepts anything from one day up.
Should I start MTA-STS in testing or enforce mode?+
Testing. In mode: testing, senders deliver as before but report TLS failures through TLS-RPT, so publish a TLS-RPT record with it and read the reports for a week or two. When they show no failures, switch to mode: enforce and change the id. Going straight to enforce can hold back mail if an MX host has a certificate problem.
How do I change MX records without breaking MTA-STS?+
List the new hosts in the policy before you switch. Publish a policy file naming both old and new MX hosts, change the id in the TXT record, and only then update the MX records; remove the old hosts the same way afterwards. Senders holding a cached policy refuse unlisted MX hosts in enforce mode until they fetch the update.
How do I turn off MTA-STS?+
Publish a policy with mode: none, change the id, and leave both online until the max_age of your previous policy has passed; then remove the records. Deleting the TXT record alone does not work, because senders keep applying a cached policy until it expires (RFC 8461 §8.3).