Record Generator

Build the SPF, DMARC, MTA-STS, and TLS-RPT records for your domain, with the exact values to publish and what to watch out for.

Nothing you type here leaves your browser except the optional MX lookup. The records are built on this page, so you can use it for any domain, including ones you do not own yet.

Mode

Mail servers that receive mail for your domain (one per line)

Policy lifetime in days: 7

Send TLS reports to

1. MTA-STS record to publish

Type: TXT

Host / name: _mta-sts (full name _mta-sts.)

Value: Generating...

2. Policy file to host

Address: https://mta-sts.example.com/.well-known/mta-sts.txt

File contents: version: STSv1 mode: testing max_age: 604800

Add every mail server that receives mail for the domain. A missing server would make senders refuse delivery to it once the policy is enforced.
testing mode reports TLS failures but never blocks mail. Run it for a few weeks, read the TLS-RPT reports, then switch to enforce.
The policy file must be served over HTTPS at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate. That needs a web host for the mta-sts name, which is the part most people need help with.
Change the id in the TXT record every time you change the policy file, or senders will keep using the old policy. This generator makes the id from the current UTC time.
Google, Microsoft, and Yahoo send mail using MTA-STS when it is published. Mail servers in other parts of the world may not.

Want Connected Geek to publish this for you?

Online fix requests are coming soon. Until then, call 248-648-1717 or email Support@ConnectedGeek.net about your domain, and our technicians will make the changes, confirm they work, and explain what we did.

Fix this for me: coming soonEmail us instead

Record Generator

Stay Connected!