MTA-STS policy generator: build the policy file and TXT record in your browser

Fill in a mode, your MX host patterns, a max_age and a policy id below, and this tool assembles both the mta-sts.txt policy file body and the _mta-sts.<your domain> TXT record as you type, entirely in your browser — nothing you enter is sent to AdminKit or anywhere else. Once you are happy with the result, host the policy file and publish the TXT record yourself, then confirm both took effect with AdminKit’s live MTA-STS check, which queries DNS and fetches the policy file for real and reports back what it actually found.

What do the policy file and the TXT record each actually do?

RFC 8461 splits MTA-STS into two pieces that both have to be published together: the _mta-sts.<domain> TXT record is a short pointer, published in DNS, that tells a sending server a policy exists and gives it a version id to detect changes by; the policy file itself, hosted over HTTPS at mta-sts.<domain>/.well-known/mta-sts.txt, is where the actual rules live — the mode, the mx hosts the policy covers, and the max_age senders should cache it for. A sender that finds the TXT record but can’t fetch a valid policy file treats that as a broken deployment, which is exactly why this tool builds both pieces together instead of just one.

The fields this tool builds from

• mode — enforce (senders must defer or reject mail they can’t deliver over TLS to a listed MX host), testing (senders only report what would have happened, without blocking anything) or none (the domain declares no MTA-STS support at all).
• mx — one or more MX host patterns the policy covers, such as mail.example.com or a wildcard like *.example.net; only meaningful (and only included in the output) for enforce and testing.
• max_age — how many seconds a sender may cache the policy before re-fetching it, as a whole number up to RFC 8461 §3.2’s own one-year (31557600) recommendation.
• id — a 1-32 character alphanumeric string the TXT record carries so senders can tell when the policy has changed; this tool suggests a UTC timestamp by default, matching the worked example in RFC 8461’s canonical IETF Datatracker record.

Limits

• This tool only builds the policy file body and the TXT record text. It never queries DNS, never fetches a URL and never publishes anything — you still have to host the file and add the record yourself, then confirm both with a live check.
• It validates the values you enter (mode keywords, MX host syntax, numeric ranges, id format) but has no way to know whether the MX hosts you list actually match your domain’s real MX records.

For the full rollout path — start in testing, add TLS-RPT with AdminKit’s TLS-RPT check for visibility into delivery reports the policy itself won’t tell you about, then move to enforce once reports confirm the MX list is accurate — see how to publish and test MTA-STS. Once your policy is live, confirm it with AdminKit’s MTA-STS check, and check your domain’s DMARC policy next, since the two protect different parts of the same mail flow — MTA-STS protects incoming transport, DMARC protects the visible From: domain.