MTA-STS policy builder
Pick your MX hosts and a mode. We'll give you the policy file (host at mta-sts.<domain>/.well-known/mta-sts.txt) and the matching DNS TXT record.
Policy inputs
Exact hosts (mail.example.com) and wildcards (*.example.com) are both valid. Use the hosts your receiving mail provider tells you to put in MX.
Output
Valid- · Mode=testing — receivers will report failures via TLS-RPT but won't actually reject. Move to enforce once you're confident.
version: STSv1 mode: testing mx: aspmx.l.google.com mx: alt1.aspmx.l.google.com max_age: 604800
v=STSv1; id=202606010357
How MTA-STS works. MTA-STS is the “HSTS for email.” You publish a policy at mta-sts.<domain>/.well-known/mta-sts.txt over HTTPS, plus a DNS TXT record at _mta-sts.<domain>. Sending MTAs fetch the policy and refuse to deliver mail unless TLS is used and the receiver's cert matches one of the listed MX names. Pair with TLS-RPT so you find out when something breaks.
See also the SPF builder, DMARC validator, and the full email security scan.
Keep hardening your email
Each record is one layer. Check the rest of yours — every tool is free, no account.