Email & DNS

MTA-STS Policy Builder

Build the MTA-STS discovery record and HTTPS policy body.

Calculations run in your browser. The tool does not send your inputs to a server.

01Your inputs

Local workspace

Start with the sample below, or enter your own values.

Policy domain

Policy revision ID

Mode

Allowed MX patterns, one per linePut each entry on its own line, following the example format.

Maximum cache age (seconds)Enter a numeric value using the unit shown in the label.

02Your result

Your result will appear here. Choose an action after checking your inputs.

A quick guide

How to use this tool

Check the example and the unit beside each input.
Enter your values and choose Build.
Review the result and assumptions, then copy what you need.

Reset example restores the starting values. Clear removes text and number inputs, returns choices to their first valid option, and removes the result.

Reference guide

Explanation and worked examples

Testing mode reports problems without requiring delivery failure. Before enforce, verify the policy URL, trusted HTTPS certificate and every legitimate MX host pattern.

Use in day-to-day IT work

Prepare staged SMTP transport-policy deployment.

Checks before applying the result

Deploy the HTTPS policy and a trusted certificate, publish the discovery record, and observe TLS reports in testing mode.
Verify all receiving MX patterns before enforce. Cached enforce policies may remain active until refreshed or expired, even after you change DNS.

New to the terminology?

SPF: Sender Policy Framework: authorises sending hosts for a domain used by SMTP.
MTA-STS: A published policy for authenticated TLS delivery to declared MX hosts.
TTL: How long a DNS answer may normally remain cached.

Keep exploring

How calculations work and where the models stop →