MTA-STS Record & Policy Generator

Pick your enforcement mode and mail servers, get the exact DNS record and policy file to publish — no account needed.

Your domain (optional — just for showing the exact host/URL to publish under)

What should happen if a connection can't be verified?

Testing — report onlyDelivery problems are reported but mail still sends normally. The safe starting point.

EnforceMail that can't be delivered over an encrypted, verified connection is held back. Only move here once testing looks clean.

None — disableTurns MTA-STS off entirely. Mostly for rolling back a policy you previously published.

Your mail servers (the hostnames in your MX record)

1. Publish this as a TXT record

_mta-sts.yourdomain.com

v=STSv1; id=202610221113

Change this id value any time you update the policy file below — mailbox providers use it to know the policy changed.

2. Host this file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt

version: STSv1
mode: testing
max_age: 604800

This part isn't DNS. MTA-STS needs this exact file served over HTTPS at that URL on a real web server — SendClear generates the content, not the hosting. Most DNS/web hosts can serve a static file at a subdomain like this; check your host's docs for a static-file or redirect rule.

Once both are live (DNS changes can take a few hours), check your domain's full setup free to confirm everything else is in order too.

Not sure what MTA-STS actually does first? Check your domain's current setup free to see where you stand.