MTA-STS and TLS-RPT checker and generator

MTA-STS makes sending servers deliver mail to you over verified TLS. TLS-RPT sends you reports when that fails.

MTA-STS and TLS-RPT generator

Builds the two DNS records and the policy file. You still need to host the file over HTTPS.

Your domainYour MX hostsExactly as your mail provider lists them. A leading *. covers one level, e.g. *.mail.example.com.ModeStart with testing, read the TLS reports, then enforce.max_age (seconds)86400 while testing; 604800 or more when enforcing.TLS-RPT report address

Enter your domain and MX hosts to see the records.

Keep your domain on your radar

A one-time check shows today. Pistos DMARC report monitoring is still being built. Create a free account now to hold your place and add your domain when it opens.

Create a free account

Questions

Where is the policy file?

At https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, served over HTTPS with a valid certificate. It must not redirect.

When do I change the id?

Every time you change the policy file. Senders only re-fetch the policy when the id in DNS changes.