MTA-STS Record & Policy Generator - iN2 LLC

Create standard-compliant MTA Strict Transport Security (MTA-STS) DNS records and policy files to enforce encrypted SMTP mail delivery.

MTA-STS Record & Policy Generator

Generate Mail Transfer Agent Strict Transport Security (MTA-STS) DNS records and policy files to protect your domain against SMTP man-in-the-middle (MITM) hijacking and TLS downgrade attacks.

1. DNS TXT Record

DNS Host/Name _mta-sts.example.com
Record Type TXT
v=STSv1; id=20260626130000

2. Policy File (mta-sts.txt)

File Path /.well-known/mta-sts.txt
HTTP Content-Type text/plain
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

Deployment Instructions

1

Host the Policy File

Create a subdomain in DNS called mta-sts.[yourdomain] pointing to a web server. Publish the policy file exactly at the HTTPS endpoint:
https://mta-sts.example.com/.well-known/mta-sts.txt
⚠ Note: The server MUST support HTTPS with a trusted, valid SSL/TLS certificate (not self-signed) and return HTTP status 200. Port 80 redirection is optional.

2

Publish the DNS TXT Record

Add the DNS TXT record for _mta-sts.[yourdomain] to signal that MTA-STS is supported. Each time you update the policy file content (e.g. changing allowed MXs or switching mode to enforce), you MUST update the id tag value in DNS to trigger mail servers to refresh their cached copy of the policy.