MTA-STS Record & Policy Generator | iN2 Tools

Create standard-compliant MTA Strict Transport Security (MTA-STS) DNS records and policy files to enforce encrypted SMTP mail delivery.

MTA-STS Record & Policy Generator

Generate Mail Transfer Agent Strict Transport Security (MTA-STS) DNS records and policy files to enforce encrypted SMTP mail delivery and prevent man-in-the-middle TLS downgrade attacks.

MTA-STS Record & Policy Settings

Generate Mail Transfer Agent Strict Transport Security (MTA-STS) DNS records and policy files to protect your domain against SMTP man-in-the-middle (MITM) hijacking and TLS downgrade attacks.

1. DNS TXT Record

DNS Host/Name _mta-sts.example.com
Record Type TXT
v=STSv1; id=20260626130000

2. Policy File (mta-sts.txt)

File Path /.well-known/mta-sts.txt
HTTP Content-Type text/plain
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

Deployment Instructions

1

Host the Policy File

Create a subdomain in DNS called mta-sts.[yourdomain] pointing to a web server. Publish the policy file exactly at the HTTPS endpoint:
https://mta-sts.example.com/.well-known/mta-sts.txt
⚠ Note: The server MUST support HTTPS with a trusted, valid SSL/TLS certificate (not self-signed) and return HTTP status 200. Port 80 redirection is optional.

2

Publish the DNS TXT Record

Add the DNS TXT record for _mta-sts.[yourdomain] to signal that MTA-STS is supported. Each time you update the policy file content (e.g. changing allowed MXs or switching mode to enforce), you MUST update the id tag value in DNS to trigger mail servers to refresh their cached copy of the policy.

What Is MTA-STS (RFC 8461)?

MTA-STS (SMTP MTA Strict Transport Security) (RFC 8461) allows domain owners to declare that inbound SMTP email connections must use Transport Layer Security (TLS) encryption with valid X.509 server certificates.

Why Opportunistic TLS (STARTTLS) Is Vulnerable

Standard SMTP uses opportunistic TLS (STARTTLS), which is vulnerable to active Man-in-the-Middle (MITM) downgrade attacks where an attacker strips the 250-STARTTLS capability keyword from the SMTP server response, forcing mail to be transmitted in cleartext.

MTA-STS Policy Modes

  • mode: testing: Sending mail servers attempt TLS encryption and send aggregate error reports via TLS-RPT (RFC 8460), but deliver unencrypted mail if TLS fails.
  • mode: enforce: Sending mail servers strictly reject/refuse delivery if TLS encryption or certificate validation fails.
  • mode: none: Disables the domain's MTA-STS policy.

Related Email Security Tools