MTA-STS policy generator

Build the HTTPS policy file and the _mta-sts DNS TXT - both update live.

1. Domain

Domain (apex)

Loads _mta-sts TXT and, if reachable, the HTTPS policy file.

Mode

MX hosts covered by the policy

One hostname per line (appears as mx: lines in the policy file).

max_age (seconds)

DNS id token

Bump when the policy file changes.

DNS TXT for _mta-sts.<domain>:

v=STSv1; id=1

BIND preview

_mta-sts.<domain>. IN TXT "v=STSv1; id=1"

Policy URL

https://mta-sts.<domain>/.well-known/mta-sts.txt

Policy body (HTTPS)

version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

Check MTA-STS

curl -sS 'https://tools.onesystems.ch/api/tools/mail-generate?kind=mta-sts&domain=example.com&mx=mail.example.com&mode=testing'