Learn
Documentation How To Blog Deliverability GuideFree Tools
Subject Line Tester SPF Checker & Generator DMARC Record Generator DMARC Checker DKIM Checker & Generator Email Header Analyzer MX Lookup MTA-STS Checker & Generator BIMI Checker & Generator Email Deliverability Test Email Spam Checker Email Template BuilderCheck that your MTA-STS record, policy file and TLS-RPT record are set up and that the policy covers every mail server. Or generate all three below.
We look up the _mta-sts record, fetch your policy file over HTTPS, compare it with your MX records, and check TLS-RPT.
List the MX hosts from your mailbox provider. The generator runs in your browser.
1. TXT record
Host
Value
2. Policy file
Serve this as plain text at with a valid HTTPS certificate.
3. TLS-RPT record
Host
Value
Whenever you change the policy file, change the id in the TXT record too, or senders keep the old policy until max_age runs out.
MTA-STS (Mail Transfer Agent Strict Transport Security) tells other mail servers that your domain only accepts mail over TLS with a valid certificate. Without it, an attacker who can intercept the connection can strip encryption and read or redirect mail meant for you.
No. MTA-STS protects mail coming in to your domain. It is set up next to your MX records. Your sending reputation depends on SPF, DKIM and DMARC.
Start with testing and a TLS-RPT record. Senders keep delivering but send you daily reports of TLS problems. Once a couple of weeks of reports come back clean, switch to enforce and update the id in the TXT record.
Senders fetch the policy from https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, and the certificate on that host must be valid. Any static host works: a small web server, a CDN, or a service like GitHub Pages or Cloudflare.
TLS Reporting (TLS-RPT) is a TXT record at _smtp._tls.yourdomain.com that names an address for reports. Senders that support it email you a daily summary of connections that failed TLS, so you find problems before you enforce.
Check which servers your policy has to cover with the MX lookup.
Broadcast is self-hosted email marketing software. It watches your SPF, DKIM and DMARC records and tells you when one breaks. Pay once, run it on your own server.
One-time payment, unlimited emails forever
"I was tired of spending hundreds per month on Beehiiv. Then I found Broadcast and now I can scale at my own pace without burning money I worked hard for."
@bensnichedsitesFor technical founders & developers
For agencies and consultants managing multiple client deployments