MTA-STS & TLS-RPT Generator
MTA-STS tells other mail servers to require an encrypted, certificate-validated connection when delivering mail to you. TLS-RPT gets you a report when a sender's TLS connection attempt fails. Fill this in to generate all three pieces you need to publish.
📖 Guide: How MTA-STS & TLS-RPT work
Last updated: September 9, 2026
How to use this tool
- Enter your domain and list every mail server hostname this policy should cover — usually the same hosts as your MX records.
- Start in
testingmode: it reports failures without blocking any mail, so you can catch a misconfiguration before it costs you delivery. - Click Generate to get the TXT record, the policy file content, and the TLS-RPT reporting record together.
- Publish the TXT record, then host the policy file exactly as shown, over HTTPS, at the URL given.
- Once testing mode looks clean for a week or two, switch the mode to
enforceand republish.
Sample record
A finished setup publishes two TXT records and a policy file. The main policy record, at _mta-sts.example.com:
...and the policy file itself, hosted at https://mta-sts.example.com/.well-known/mta-sts.txt:
It's needed to stop mail addressed to your domain from being silently downgraded to an unencrypted or unauthenticated connection by an attacker sitting between servers — the same category of protection HTTPS gives web traffic, applied to SMTP.
Step 1: Check what's live now
See whether MTA-STS and TLS-RPT are already published for this domain before generating a new policy.