This MTA-STS record generator creates both pieces you need for deployment:

  • DNS TXT record at _mta-sts.yourdomain
  • .well-known/mta-sts.txt policy file content

Suggested rollout approach

  • Start with mode: testing to validate behavior without enforcement.
  • Move to mode: enforce when you are confident all receiving paths support TLS.

The max_age value controls how long receivers cache your policy. Use shorter values during rollout, then increase once stable.

Deployment checklist

  1. Publish generated DNS TXT record
  2. Host generated policy file on HTTPS
  3. Run the MTA-STS checker to verify rollout
  4. Pair with TLS reporting for visibility

Before you enforce

Confirm that every MX host listed in the policy is current, that HTTPS hosting is stable, and that certificate renewals for the policy endpoint are monitored. MTA-STS is most useful when DNS, HTTPS, and mail routing are managed together instead of updated independently.