Free email security tool
List the mail servers that receive mail for your domain and choose a mode. You get the TXT record and the policy file, with the exact address the file must be served from.
Create the mta-sts host name in DNS, serve the policy file from it over HTTPS with a valid certificate, then add the TXT record. Do it in that order: a TXT record that points to a missing file is ignored. Afterwards, confirm with the MTA-STS Checker, which fetches the file the way a sending server would.
mode is testing (report only), enforce (refuse delivery on failure) or none (withdraw the policy). mx lists the mail servers senders may deliver to; each needs a certificate valid for its own name. max_age is how long senders cache the policy. id in the TXT record signals that the file changed.
It does not read your MX records. The mx list is exactly what you type, and a host you leave out will stop receiving mail from MTA-STS senders in enforce mode. Compare the list with your published MX records before enforcing.
Add your domain to CloudSpex to monitor the MTA-STS record and policy file continuously and get alerted when they stop matching your mail servers.
Start Monitoring FreeTwo things. A TXT record at _mta-sts.yourdomain.com with a policy id, and a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Senders ignore the TXT record if the file cannot be fetched.
Start with testing, together with a TLS-RPT record. In testing mode senders deliver as usual and report failures. Switch to enforce once the reports show that every one of your MX hosts passes.
In enforce mode, senders that support MTA-STS will refuse to deliver to that host. Mail is queued and eventually bounced. This is the most common MTA-STS outage, usually after a mail provider migration.
Senders cache the policy for max_age seconds and re-fetch the file only when the id in the TXT record changes. If you edit the file without changing the id, senders keep using the old policy.