MTA-STS and TLS-RPT generator

Make Gmail, Microsoft and other senders deliver mail to your domain only over verified, encrypted connections – and get a daily report when that fails.

What these records do

Email between servers is encrypted only if both sides agree, and an attacker in the middle can quietly strip that encryption. MTA-STS publishes a policy that says “only deliver to these mail servers, and only over TLS with a valid certificate”. TLS-RPT asks senders to email you a daily JSON report of any delivery that failed those checks.

Where to host the policy file

• It must be reachable over HTTPS with a valid certificate at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, served as plain text.
• Easy options: a site on your existing web server, Cloudflare Workers or Pages, or GitHub Pages / Netlify with the custom domain mta-sts.yourdomain.com.
• Wildcards are allowed for the first label only, for example mx: *.mx.cloudflare.net.
• When you change the policy (new mail provider, testing → enforce), update the file first, then change the id in the _mta-sts record so senders fetch it again.

Check the result with the domain checker: MTA-STS and TLS-RPT should both show ✔.