PolicyForgeEmail security tools

DNS guide

Create an MTA-STS DNS TXT record

The DNS record announces that your domain has an MTA-STS policy. The policy file itself lives separately at a secure HTTPS address.

Record example

Host: _mta-sts.example.com
Type: TXT
Value: v=STSv1; id=20260904

Three checks before publishing

  1. Publish the TXT record at _mta-sts.yourdomain.com, not at the root domain.
  2. Host the policy at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.
  3. Change the DNS id every time you change the hosted policy.

Next: testing versus enforce mode