MTA-STS Policy Generator

MTA-STS (Mail Transfer Agent Strict Transport Security) is a relatively new standard that forces email servers to use encrypted TLS connections when delivering mail to your domain. Without it, SMTP connections can fall back to plain text — even if your mail server supports TLS — because an attacker can intercept the initial handshake and strip the encryption signal. This is called a downgrade attack, and it's more common than most people realize.

The way MTA-STS works is straightforward. You publish a DNS record announcing that your domain has an MTA-STS policy, and you host a policy file on a specific HTTPS URL. When a sending server wants to deliver mail to your domain, it checks for the DNS record, fetches the policy file over HTTPS, and then only delivers the message if it can establish a valid TLS connection to one of the MX hosts listed in your policy.

MTA-STS pairs well with TLS-RPT (TLS Reporting), which lets you receive reports when sending servers encounter TLS failures. Together, they give you both enforcement and visibility. If you're serious about protecting email in transit — not just at rest — MTA-STS is an important piece of the puzzle that complements your existing SPF, DKIM, and DMARC setup.