MTA-STS and TLS-RPT policy generator

Enter your domain and mail hosts to get the two DNS records and the policy file that make senders deliver to you over verified TLS.

MTA-STS and TLS-RPT generator

Builds the two DNS records and the policy file. You still need to host the file over HTTPS.

Your domainYour MX hostsExactly as your mail provider lists them. A leading *. covers one level, e.g. *.mail.example.com.ModeStart with testing, read the TLS reports, then enforce.max_age (seconds)86400 while testing; 604800 or more when enforcing.TLS-RPT report address

Enter your domain and MX hosts to see the records.

Keep your domain on your radar

A one-time check shows today. Pistos DMARC reads the reports mailbox providers send about your domain and tells you when a sender fails or a record changes.

Create an account

Questions

Where do I host the policy file?

On the host mta-sts.yourdomain over HTTPS with a valid certificate, at /.well-known/mta-sts.txt. It must not redirect.

Is anything stored?

No. The files are built in your browser.

About this tool

What it builds

The _mta-sts TXT record, the policy file for mta-sts.yourdomain/.well-known/mta-sts.txt, and the _smtp._tls record that sends you TLS failure reports.

Roll it out in testing mode

Start with mode: testing, read the TLS reports for a couple of weeks, then switch to enforce. Change the id in the DNS record every time the policy file changes.