Force TLS on Every Inbound Email

Generate your records

Enter your domain, then hit Auto-detect MX hosts to fill in your MX hostnames automatically. The generator assembles the DNS TXT record, the policy file you host at mta-sts.yourdomain, and the optional TLS-RPT reporting record — starting in testing mode, the only safe first step.

Record ready? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

After you publish

1. Publish the TXT record at _mta-sts + your domain (for example _mta-sts.example.com) — not at the domain root.
2. Serve the policy file over HTTPS at https://mta-sts.yourdomain/.well-known/mta-sts.txt — a self-signed or expired certificate means senders ignore the whole policy. This is the step most guides skip; it is also the step that makes the record real.
3. Confirm the record is live — query _mta-sts.yourdomain from any DNS lookup and fetch the policy URL yourself before relying on it.
4. Flip to enforce only after TLS-RPT says so — watch your TLS-RPT reports for a week or two. Clean inbound TLS in testing mode is the green light for mode: enforce.

• Run the Free Email Domain Trust Checker
• Verify the MTA-STS record itself — once DNS propagates, confirm the v=STSv1 record parses, the policy file fetches over HTTPS, and every MX host is covered by an mx: pattern.
• Verify the TLS-RPT record itself — once DNS propagates, confirm the v=TLSRPTv1 companion record parses and your report destination is valid.

Publish it at your DNS provider

The DNS record is the same everywhere: a TXT record at _mta-sts + your domain (for example _mta-sts.example.com), pasting the value from the generator. Only the buttons differ. Three common providers:

Cloudflare — Dashboard, your domain, DNS, Records, Add record. Type: TXT. Name: _mta-sts. Content: paste the generated record. TTL: Auto. Save.

GoDaddy — My Products, DNS next to your domain, Add. Type: TXT. Host: _mta-sts. TXT Value: paste the generated record. Leave the TTL default. Save.

Amazon Route 53 — Hosted zones, your domain, Create record. Record name: _mta-sts. Record type: TXT. Value: paste the generated record inside double quotes (Route 53 requires them). Save.

Then confirm the foundation is actually solid: MTA-STS hardens the connection layer, but it sits on top of working SPF, DKIM, and DMARC. Run the Free Email Domain Trust Checker and confirm your authentication foundation before you harden transport.

Complete the authentication set

MTA-STS is the fifth leg: it protects the connection after SPF, DKIM, DMARC, and BIMI have done their jobs. Generate the rest of the set, free, in your browser:

• Free SPF Record Generator
• Free DKIM Record Generator
• Free DMARC Record Generator
• Free BIMI Record Generator

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What is MTA-STS? MTA-STS (MTA Strict Transport Security) tells sending mail servers that your domain requires TLS. It is a DNS TXT record (v=STSv1 plus a policy id) at _mta-sts.yourdomain, pointing senders at an HTTPS policy file that lists your MX hosts and the enforcement mode.

What does the policy id do? The id is a version stamp, usually a UTC date like 20261015T064800Z. Senders cache your policy and only re-fetch it when the id changes. Change the id every time you edit the policy — otherwise senders keep enforcing the old one.

Should I use testing or enforce mode? Always start with mode=testing. In testing mode senders log failures instead of bouncing mail. Flip to enforce only after TLS-RPT reports show clean inbound TLS for a week or two — enforce mode bounces any mail that cannot negotiate TLS with your MX hosts.

Where do I publish the MTA-STS TXT record? Publish it as a DNS TXT record at _mta-sts.yourdomain (for example _mta-sts.example.com), not at the domain root. The policy file itself lives at https://mta-sts.yourdomain/.well-known/mta-sts.txt and must be served over HTTPS with a valid certificate.

Do I need TLS-RPT as well? TLS-RPT is not required, but without it you are blind: it is the reporting companion that tells you about inbound TLS failures while you run MTA-STS in testing mode. The generator adds the _smtp._tls companion record when you give it a report address.