MTA-STS Policy & DNS TXT Record Generator (RFC 8461)
Enforce TLS email encryption and prevent SMTP man-in-the-middle downgrade attacks (STARTTLS).
Execution runs 100% locally inside the browser sandbox using HTML5 Canvas, Web Cryptography Subtle API, and Web Workers. No data is ever transmitted across the network.
Zero network latency. Operates completely offline with zero dependencies on third-party backend servers or cloud services.
Built according to official RFC specifications, cryptographic test vectors, and enterprise-grade data transformation standards.
How to Use MTA-STS Policy & DNS TXT Record Generator (RFC 8461)
Provide your domain name and authorized mail server patterns.
Choose enforce, testing, or none.
Download mta-sts.txt and copy the _mta-sts TXT record.
Frequently Asked Questions
Where should mta-sts.txt be hosted?
It must be hosted at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt over HTTPS with a valid certificate.
What is the difference between enforce and testing mode?
Enforce mode instructs sending mail servers to refuse delivery if TLS is absent, while testing mode delivers mail and reports failures via TLS-RPT.
Related Security & Network Tools
View all →Split master passwords into M-of-N threshold shares with GF(256) math.
Generate cryptographically secure 12, 18, or 24-word seed phrases.
Calculate network address, broadcast, usable host IP range, and masks.
Derive secure keys with customizable iterations, salts, and SHA hashes.