Bug Circuit

Free tool · no signup

MTA-STS and TLS-RPT generator

Make sure other mail servers encrypt every message they send to you. Get the policy file, the DNS record and the report record in one go, with a safe testing mode first.

By the Bug Circuit security team · Last updated

Your mail setup

  • Add at least one MX host, exactly as it appears in your DNS MX records, for example aspmx.l.google.com.
What is MTA-STS? A policy that tells other mail servers to deliver to you only over an encrypted connection with a valid certificate, so a network attacker cannot downgrade or read the mail. It needs a small policy file on a web server, one DNS record, and ideally a TLS-RPT record so you get reports.

How it works

What MTA-STS protects against

Email between servers uses opportunistic encryption: the sender asks for TLS, and if the receiver does not offer it, or an attacker on the network strips the offer, the message goes in plain text. MTA-STS (RFC 8461) closes that hole for mail sent to your domain. The sending server fetches your policy over https, and from then on it refuses to deliver to a server that cannot present a valid certificate for one of your listed MX hosts.

It protects incoming mail only. Mail you send is protected by the other side's policy, if they publish one.

The three pieces

First, a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. It lists your mode, your MX hosts and how long senders may cache it (max_age). The host needs a valid certificate and must answer with a 200 status and no redirect. Second, a TXT record at _mta-sts.yourdomain.com with v=STSv1 and an id. Senders re-fetch the policy only when the id changes, so change it whenever you edit the file. Third, a TLS-RPT record at _smtp._tls.yourdomain.com. Senders use it to email you daily reports about connection failures, and those reports are how you learn what enforce mode would break.

Roll it out safely

Start in testing mode with a short max_age. In testing, senders deliver even when the checks fail but still report the failures. After a week or two of clean reports, switch to enforce and raise max_age to a week or more. In enforce mode, a wrong MX name or an expired certificate means mail to you is held back or bounced, so keep your certificates renewing and update the policy before you change mail providers.

Worked examples

Google Workspace, testing mode

MX hosts aspmx.l.google.com and *.aspmx.l.google.com.

version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 86400

Check your own MX records and copy them exactly, because they depend on your plan and region.

Microsoft 365, enforced for a week

One wildcard MX host and a week-long cache.

version: STSv1
mode: enforce
mx: *.mail.protection.outlook.com
max_age: 604800

Microsoft 365 gives each domain an MX host ending in mail.protection.outlook.com, so the wildcard covers it. Move to enforce only after clean TLS-RPT reports.

The two DNS records

For example.com with an id from today's date and time.

_mta-sts.example.com      TXT  "v=STSv1; id=20261105090000"
_smtp._tls.example.com    TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

Change the id (for example to a new timestamp) every time the policy file changes.

Frequently asked questions

Do I need MTA-STS if I already have SPF, DKIM and DMARC?
They protect different things. SPF, DKIM and DMARC are about who may send as your domain. MTA-STS is about encrypting mail on its way to you. It does not replace them and they do not replace it.
What does the id in the DNS record do?
Senders cache your policy, and the id tells them when it has changed. If you edit the policy file but keep the same id, senders keep using the old copy until max_age runs out. Use a timestamp so it always changes.
What is the difference between testing and enforce?
In testing, senders report problems but still deliver the mail. In enforce, a sender must refuse to deliver to a server that is not encrypted or has the wrong certificate. Always run testing first.
Do I need a web server just for this?
Yes, a very small one. The policy is served over https from mta-sts.yourdomain.com, so you need a host with a valid certificate for that name. A static site on any hosting service or a CDN works.
What is TLS-RPT?
SMTP TLS Reporting (RFC 8460). Mail providers that support it send you a daily summary of how many connections to your servers succeeded or failed and why. It works with or without MTA-STS and it is the way to see problems before enforcing.
What max_age should I use?
A day while testing, then a week or more once you enforce. The maximum is one year. A very short age in enforce mode gives little protection because senders forget the policy quickly.
How do I switch it off?
Publish a policy with mode: none and a new id, and keep it online until the old max_age has passed. Only then remove the DNS record and the web server.

Keep reading

Email Spoofing CheckerTest SPF, DKIM and DMARC.DMARC Record GeneratorTell receivers what to do with spoofed mail.SSL Certificate CheckerCheck the certificate on your policy host.DNS Record LookupSee the records you published.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing

MTA-STS and TLS-RPT Record Generator · Bug Circuit