MTA-STS Policy Generator

MTA-STS takes three pieces to deploy, not one: a TXT record announcing the policy, a host serving the policy file over HTTPS with a certificate valid for it, and the policy file itself. This builds all three, plus the TLS-RPT record you'll want alongside them. Runs entirely in your browser — nothing you type is sent anywhere.

1. Serve this file

At https://mta-sts.example.com/.well-known/mta-sts.txt, as text/plain, with no redirect.

2. Publish these DNS records

Things that catch people out

The certificate. The policy host needs a certificate valid for mta-sts.<domain> specifically. One covering the bare domain and www will not do, and this is the single most common reason a correct-looking MTA-STS deployment does nothing.
The id has to change. Senders cache a policy until max_age expires or the id in the TXT record changes. Edit the policy file without bumping the id and your fix doesn't reach anyone.
Start in testing. Under enforce, any MX host missing from the mx list has mail refused outright by senders honouring the policy — including backup MX and any provider you forgot. Testing mode reports the same failures via TLS-RPT while still delivering.
No redirects. RFC 8461 forbids senders from following them, so serving the policy behind a redirect is the same as not serving it.

Once it's published, confirm it end to end with the MTA-STS Checker. Background in what MTA-STS and TLS-RPT actually do.