MTA-STS Generator

MTA-STS (Mail Transfer Agent Strict Transport Security) is an email security standard that allows domain owners to declare that their mail servers support TLS encryption and that sending mail servers must refuse to deliver email if a valid TLS connection cannot be established. It prevents STARTTLS downgrade attacks where an attacker strips TLS from the SMTP connection. MTA-STS requires a DNS TXT record and a policy file hosted at a specific HTTPS URL.

The policy file must be hosted at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt and served with Content-Type: text/plain over a valid HTTPS connection. This requires setting up a subdomain mta-sts.yourdomain.com with a valid SSL certificate. The policy file specifies the mode (none, testing, enforce), max_age, and the authorised MX hostnames. The DNS TXT record at _mta-sts.yourdomain.com provides a policy ID string.

In testing mode, sending servers evaluate the policy but do not refuse delivery if TLS cannot be established — they only send failure reports to your TLS-RPT address. In enforce mode, sending servers must abort delivery if the MX hostname does not match the policy or if a valid TLS connection cannot be established. Always start in testing mode, monitor TLS-RPT reports for failures, then switch to enforce once you confirm all MX servers have valid TLS configurations.

No — MTA-STS enforces the use of STARTTLS rather than replacing it. SMTP still uses the STARTTLS command to upgrade a plain connection to TLS, but MTA-STS requires that the upgrade succeed and that the server's certificate is valid and matches an authorised MX hostname. Without MTA-STS, STARTTLS is opportunistic — it is attempted but not enforced, leaving it vulnerable to downgrade attacks. MTA-STS makes STARTTLS mandatory for participating senders.