Discuss your project

TOOLBOX · GENERATOR

Set UpMTA-STS.

Enter mail servers and copy the policy file, MTA-STS and TLS-RPT records: start with testing, then enforce. Runs only in your browser.

Examples

An example fills the form with suitable values. Your domain is kept; if it is empty, example.at is used.

Domain and Mail Servers

The domain after @ in your addresses.

The names from your MX records, one per line. For Exchange Online, Microsoft specifies *.mail.protection.outlook.com; if DNSSEC is enabled there, use the name ending in mx.microsoft.

Enter the mail servers from your MX records, one per line. The policy must cover every MX record.

Policy

Start with testing and switch to enforce only after TLS reports are clean.

Mode (mode)

Leave empty to use the current time in UTC. Publish a new id whenever the file changes.

TLS Reports (TLS-RPT)

Senders report daily on whether encrypted delivery succeeded. Without these reports, you notice errors only when emails are missing.

Email addresses or https:// URLs of a reporting service, one per line.

Enter a TLS reporting address (e.g. tlsrpt@example.at), or turn TLS-RPT off.

Your MTA-STS Records

Enter your domain and mail servers above, or select an example. The file and DNS records are generated here as you type.

Browser only: this tool does not send your input to TOMORIS or third parties and does not store it.

STEP BY STEP

Three Parts.
One Policy.

MTA-STS consists of a file on a web server and a DNS record; TLS-RPT provides the reports. Microsoft Learn describes the same process for Exchange Online.

  1. 01

    Prepare the mta-sts Subdomain

    mta-sts.<domain> points through an A, AAAA or CNAME record to a web server with a valid certificate for that exact name.

  2. 02

    Host the File

    Save the policy with mode: testing at /.well-known/mta-sts.txt, as text/plain and without a redirect.

  3. 03

    Create DNS Records

    _mta-sts with the id, and _smtp._tls for TLS reports. MTA-STS becomes visible to senders only now.

  4. 04

    Read Reports

    TLS reports show whether encrypted delivery succeeds. Check the current state with the Email Security Check (German).

  5. 05

    enforce

    Change the file to mode: enforce, then change the id. Follow the same order for every later change.

COMMON MISTAKES

Where MTA-STS
Often Goes Wrong.

  • Mail Server Missing from the File

    After an MX change, the new name is absent from the policy. With enforce, senders using Exchange Online then receive non-delivery report 5.4.8: “MX hosts of <domain> failed MTA-STS validation”.

  • No Certificate for mta-sts

    Without a valid certificate for mta-sts.<domain>, senders discard the policy (RFC 8461, Section 3.3). The SSL/TLS check shows the current state.

  • Redirect to the Website

    If mta-sts.<domain> redirects to www, the policy is invalid: senders must not follow redirects (RFC 8461, Section 3.3).

  • id Left Unchanged

    Without a new id, senders keep the old policy until max_age expires.

  • enforce Without Reports

    Without TLS-RPT, delivery problems become apparent only when emails are missing.

  • Wildcard for Every Service

    Microsoft intends *.mail.protection.outlook.com only for Exchange Online. For other services, list mail servers individually.

SOURCES AND NEXT STEPS

Based on Standards
and Vendor Guidance.

QUESTIONS

Good to Know.

Why do I need MTA-STS?

Mail servers usually encrypt connections with STARTTLS, but only if it works. Someone who can manipulate the connection can suppress encryption or redirect it to their own server (RFC 8461, Section 1). With MTA-STS you declare: deliver mail to my domain only over an encrypted connection, with a valid certificate, and only to these mail servers.

Where must the policy file be hosted?

At https://mta-sts.<your domain>/.well-known/mta-sts.txt, as text/plain (RFC 8461, Section 3.2). The server needs a valid certificate for mta-sts.<your domain>, must respond with status 200 and must not redirect (Section 3.3). According to Microsoft, Exchange Online does not host the file for you.

Why start with testing?

In testing mode, senders continue delivering even if validation fails and report this through TLS-RPT (RFC 8461, Section 5). This reveals missing mail servers or certificate problems before emails are held up. Microsoft recommends the same approach for Exchange Online.

When do I change the id?

Whenever the file changes. Senders fetch the policy again only when the id in DNS changes; otherwise they keep the old version until max_age expires. Replace the file first, then change the DNS record (RFC 8461, Section 8.1).

Does MTA-STS also protect emails I send?

No. Your policy applies to emails sent to your domain. When sending, the recipient’s policy applies; Microsoft says Exchange Online checks it automatically without configuration.

Is my input transmitted?

No. The generator runs entirely in your browser. The domain, mail servers and addresses are neither sent nor stored.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result