Suped

Hosted MTA-STS that keeps TLS policy out of DNS busywork

Suped publishes, validates, monitors, and maintains your MTA-STS policy so mail servers delivering to your domain know TLS is required.
Get started
MoneyMe logoKnovos logo
MTA-STS policy hosting

Pick the policy,
Suped publishes the rest

Configure mode, max age, and MX hosts in the real app layout. Suped validates the records, hosts the HTTPS policy file, and keeps monitoring the result.

Choose your MTA-STS policy
example.com
mta-sts.txt
Max age
MX hosts
aspmx.l.google.com
alt1.aspmx.l.google.com
Policy file preview
version: STSv1
mode: enforce
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
max_age: 86400
Hosted MTA-STS
Live
Served policy
enforce
version: STSv1
mode: enforce
mx: aspmx.l.google.com, alt1.aspmx.l.google.com
max_age: 86400
_mta-sts DNS
Verified
Type
CNAME
Host
_mta-sts
Value
example-com.mta-sts.dns.suped.com.
Policy hosting
Verified
Type
CNAME
Host
mta-sts
Value
mta-sts-hosting.suped.com.
Monitoring checks
_mta-sts TXT responsev=STSv1
HTTPS policy file200 OK
MX coverageMatched
MTA-STS policy enforce, max age 86400, 2 MX hosts

What is hosted MTA-STS?

MTA-STS lets your receiving domain publish a rule that mail servers delivering to your MX hosts must use TLS. The required pieces are the _mta-sts DNS signal and a policy file served over HTTPS from mta-sts.<domain>.

Hosted MTA-STS is the MTA-STS service that makes those pieces operational. Suped handles MTA-STS hosting, MTA-STS policy hosting, validation, monitoring, and maintenance after your DNS owner adds the CNAME records once.

  • Publish the required MTA-STS signal without running DNS automation yourself
  • Host the policy file at mta-sts.<domain> over HTTPS
  • Validate policy mode, max age, and MX host coverage before enforcement
  • Monitor for missing HTTPS hosting, stale IDs, and MX drift
  • Keep MTA-STS management in the Suped dashboard
How hosted MTA-STS is published
Your DNS provider
example.com
CNAME_mta-sts to Suped DNS
CNAMEmta-sts to Suped HTTPS hosting
Suped serves the DNS signal and policy file
Suped hosted endpoints
Live
_mta-sts TXT
v=STSv1; id=1713926400
HTTPS policy
/.well-known/mta-sts.txt
MX coverage
3 hosts matched

MTA-STS policy hosting without a web server

MTA-STS hosting
MTA-STS normally requires a valid HTTPS endpoint at mta-sts.<domain> and a policy file at a fixed path. Suped hosts that policy file, manages certificates, validates the response, and keeps the published policy aligned with your dashboard settings.
Get started
outcome left image

Keep TLS policy matched to your real MX records

MTA-STS management
MTA-STS enforcement only works when the policy file covers the MX hosts that actually receive your mail. Suped compares the configured hosts against DNS, flags missing or extra MX records, and helps you update the hosted policy before stale records weaken transport security.
Get started
outcome left image

Publish once. Keep transport security current.

A stale MTA-STS policy can leave valid MX hosts uncovered or keep old hosts in scope. Suped turns hosted MTA-STS into an operated service with validation, policy hosting, and ongoing checks.

Get started
Suped dashboard

Everything an MTA-STS service should handle

MTA-STS policy hosting is more than serving a text file. A real hosted MTA-STS service has to validate the DNS signal, HTTPS hosting, policy contents, and MX coverage every time they drift.
MTA-STS signal
_mta-sts.example.com
TXT
v=STSv1; id=1713926400
_mta-sts TXT signal
Suped publishes the required v=STSv1 TXT response behind your delegated _mta-sts record, including the ID receivers use to refresh policy.
Policy file
https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: aspmx.l.google.com
max_age: 86400
Policy file hosting
Suped hosts the MTA-STS policy file over HTTPS at mta-sts.<domain>, with valid certificate handling and the exact path receivers expect.
MX coverage
aspmx.l.google.commatched
alt1.aspmx.l.google.commatched
legacy.mail.example.comstale
MX coverage checks
Bad MX coverage weakens protection. Suped checks that the hosted policy includes the mail servers currently published in DNS.
HTTPS policy hosting
200 OK
Valid certificate and policy path
HTTPS availability
Missing HTTPS hosting breaks MTA-STS. Suped monitors policy availability so receivers can fetch the file when they need it.
Policy change
Modetesting to enforce
Max age86400
Dashboard policy changes
Change mode, max age, and MX hosts from Suped. Hosted MTA-STS management keeps policy changes out of manual file edits.
Monitoring
DNS signal
Policy file
MX match
Problem monitoring
Invalid policies, stale records, missing endpoints, and MX drift are surfaced before they quietly weaken transport security.

Automated DMARC means more time, less errors and faster results

Become DMARC compliant to stop landing in spam and protect yourself from impersonation attacks, automatically with no expertise.

The manual way

Experts only
Parsing raw XML aggregate reports (RUA)
Endless spreadsheet analysis
Complex DNS syntax management
No alerts for new threats
Reactive troubleshooting
Manually cross-referencing IP addresses
Lacks historical trend data
Automated DMARC

Automated with Suped

Everything you need for enterprise-grade DMARC management.
No expertise required
Real-time visual reporting
Proactive threat monitoring
Automated sender verification
Automated parsing and sender categorization
Guided steps to fix DMARC, SPF and DKIM issues
Continuous monitoring of authorized senders
Less than 90 days to enforcement vs 12+ months manually
Get started

Hosted MTA-STS FAQs

You have questions about hosted MTA-STS, we have answers.

Here's why customers love Suped for DMARC monitoring

Read customer stories
MONEYME cover

How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped

See how MONEYME uses Suped
Jam Cyber cover

How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped

See how Jam Cyber uses Suped
DigiBean cover

How DigiBean simplified DMARC monitoring and improved email security for their MSP clients

See how DigiBean uses Suped
Alliance Group cover

How Alliance Group moved from reactive guesswork to proactive email management with Suped

See how Alliance Group uses Suped
Maaser cover

How Suped gave Maaser the confidence to finally move to strict DMARC enforcement

See how Maaser uses Suped
G2 LeaderG2 Users Most Likely To RecommendG2 Easiest To Do Business WithG2 High PerformerG2 Best Estimated ROI
DMARC monitoring

Start monitoring your DMARC reports today

Suped DMARC platform dashboard

What you'll get with Suped

Real-time DMARC report monitoring and analysis
Automated alerts for authentication failures
Clear recommendations to improve email deliverability
Protection against phishing and domain spoofing
Get started - free
Product
DMARC monitoring
Hosted DMARC
Hosted SPF
Hosted MTA-STS
SPF flattening
Blocklist monitoring
Tools
Domain health checker
DMARC checker
SPF checker
DKIM checker
DMARC record generator
Email tester
Blocklist checker
Resources
Docs
Customers
Blog
How we compare
Learn
Contact
About

Suped

Privacy policy
Terms of service
© 2026 Suped Pty Ltd
LinkedInX