Suped

Hosted MTA-STS/TLS-RPT for enforced TLS and clear reporting

Suped publishes and maintains your MTA-STS policy, collects TLS-RPT reports, and shows which mail connections passed or failed TLS.
Get started
MoneyMe logoKnovos logo
MTA-STS policy hosting

Pick the policy,
Suped publishes the rest

Configure mode, max age, and MX hosts in the real app layout. Suped validates the records, hosts the HTTPS policy file, and keeps monitoring the result.

Choose your MTA-STS policy
example.com
mta-sts.txt
Max age
MX hosts
aspmx.l.google.com
alt1.aspmx.l.google.com
Policy file preview
version: STSv1
mode: enforce
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
max_age: 86400
Hosted MTA-STS/TLS-RPT
Live
Served policy
enforce
version: STSv1
mode: enforce
mx: aspmx.l.google.com, alt1.aspmx.l.google.com
max_age: 86400
_mta-sts DNS
Verified
Type
CNAME
Host
_mta-sts
Value
example-com.mta-sts.dns.suped.com.
Policy hosting
Verified
Type
CNAME
Host
mta-sts
Value
mta-sts-hosting.suped.com.
Monitoring checks
_mta-sts TXT responsev=STSv1
HTTPS policy file200 OK
MX coverageMatched
MTA-STS policy enforce, max age 86400, 2 MX hosts

What are hosted MTA-STS and TLS-RPT?

MTA-STS lets your receiving domain publish a rule that mail servers delivering to your MX hosts must use TLS. The required pieces are the _mta-sts DNS signal and a policy file served over HTTPS from mta-sts.<domain>.

TLS-RPT complements that policy with aggregate reports from sending mail providers. Reports identify policy domains, reporters, successful sessions, failed sessions, and detailed failure reasons when supplied.

Suped handles MTA-STS hosting, policy validation, monitoring, and TLS-RPT collection after your DNS owner adds the records. The domain health checker is useful when you want MTA-STS checked beside the rest of the domain's email authentication setup.

  • Publish the required MTA-STS signal without running DNS automation yourself
  • Host the policy file at mta-sts.<domain> over HTTPS
  • Validate policy mode, max age, and MX host coverage before enforcement
  • Collect TLS-RPT pass and failure counts from reporting mail providers
  • Monitor for missing HTTPS hosting, stale IDs, and MX drift
  • Keep MTA-STS management in the Suped dashboard
How hosted MTA-STS/TLS-RPT is published
Your DNS provider
example.com
CNAME_mta-sts to Suped DNS
CNAMEmta-sts to Suped HTTPS hosting
TXT_smtp._tls to Suped TLS-RPT reporting
Suped serves the policy and collects TLS reports
Suped hosted endpoints
Live
_mta-sts TXT
v=STSv1; id=1713926400
HTTPS policy
/.well-known/mta-sts.txt
MX coverage
3 hosts matched
TLS-RPT
Reports collected

MTA-STS policy hosting without a web server

MTA-STS hosting
MTA-STS normally requires a valid HTTPS endpoint at mta-sts.<domain> and a policy file at a fixed path. Suped hosts that policy file, manages certificates, validates the response, and keeps the published policy aligned with your dashboard settings.
Get started
outcome left image

Keep TLS policy matched to your real MX records

MTA-STS management
MTA-STS enforcement only works when the policy file covers the MX hosts that actually receive your mail. Suped compares the configured hosts against DNS, flags missing or extra MX records, and helps you update the hosted policy before stale records weaken transport security.
Get started
outcome left image

Publish once. Keep transport security current.

A stale MTA-STS policy can leave valid MX hosts uncovered or keep old hosts in scope. Missing TLS reporting can also hide delivery failures. Suped combines policy hosting, validation, ongoing checks, and TLS-RPT collection.

Get started
Suped dashboard

Everything an MTA-STS/TLS-RPT service should handle

MTA-STS policy hosting is more than serving a text file. A real hosted service has to validate the DNS signal, HTTPS hosting, policy contents, and MX coverage, then collect TLS-RPT data that reveals delivery failures.
MTA-STS signal
_mta-sts.example.com
TXT
v=STSv1; id=1713926400
_mta-sts TXT signal
Suped publishes the required v=STSv1 TXT response behind your delegated _mta-sts record, including the ID receivers use to refresh policy.
Policy file
https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: aspmx.l.google.com
max_age: 86400
Policy file hosting
Suped hosts the MTA-STS policy file over HTTPS at mta-sts.<domain>, with valid certificate handling and the exact path receivers expect.
MX coverage
aspmx.l.google.commatched
alt1.aspmx.l.google.commatched
legacy.mail.example.comstale
MX coverage checks
Bad MX coverage weakens protection. Suped checks that the hosted policy includes the mail servers currently published in DNS.
HTTPS policy hosting
200 OK
Valid certificate and policy path
HTTPS availability
Missing HTTPS hosting breaks MTA-STS. Suped monitors policy availability so receivers can fetch the file when they need it.
Policy change
Modetesting to enforce
Max age86400
Dashboard policy changes
Change mode, max age, and MX hosts from Suped. Hosted MTA-STS management keeps policy changes out of manual file edits.
Monitoring
DNS signal
Policy file
MX match
TLS-RPT reports
Policy and TLS-RPT monitoring
Suped surfaces invalid policies, stale records, missing endpoints, MX drift, and aggregate TLS-RPT pass and failure counts.

Automated DMARC means more time, less errors and faster results

Become DMARC compliant to stop landing in spam and protect yourself from impersonation attacks, automatically with no expertise.
The manual way
Experts only
Parsing raw XML aggregate reports (RUA)
Endless spreadsheet analysis
Complex DNS syntax management
No alerts for new threats
Reactive troubleshooting
Manually cross-referencing IP addresses
Lacks historical trend data
Automated DMARC
Automated with Suped
Everything you need for enterprise-grade DMARC management.
No expertise required
Real-time visual reporting
Proactive threat monitoring
Automated sender verification
Automated parsing and sender categorization
Guided steps to fix DMARC, SPF and DKIM issues
Continuous monitoring of authorized senders
Less than 90 days to enforcement vs 12+ months manually
Get started

Hosted MTA-STS/TLS-RPT FAQs

You have questions about hosted MTA-STS and TLS-RPT, we have answers.

Here's why customers love Suped for DMARC monitoring

Read customer stories
MONEYME cover

How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped

See how MONEYME uses Suped
Jam Cyber cover

How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped

See how Jam Cyber uses Suped
Vision Australia cover

How Vision Australia maintains full DMARC enforcement across a large domain portfolio with Suped

See how Vision Australia uses Suped
The POP Team cover

How The POP Team turns domain checks and DMARC visibility into client ready delivery work

See how The POP Team uses Suped
DigiBean cover

How DigiBean simplified DMARC monitoring and improved email security for their MSP clients

See how DigiBean uses Suped
Alliance Group cover

How Alliance Group moved from reactive guesswork to proactive email management with Suped

See how Alliance Group uses Suped
G2 LeaderG2 Users Most Likely To RecommendG2 Easiest To Do Business WithG2 High PerformerG2 Best Estimated ROI
DMARC monitoring

Start monitoring your DMARC reports today

Suped DMARC platform dashboard
What you'll get with Suped
Real-time DMARC report monitoring and analysis
Automated alerts for authentication failures
Clear recommendations to improve email deliverability
Protection against phishing and domain spoofing
Get started - free
Product
DMARC monitoring
Hosted DMARC
Hosted SPF
Hosted MTA-STS/TLS-RPT
SPF flattening
Blocklist monitoring
Tools
DMARC checker
SPF checker
DKIM checker
Domain health checker
MTA-STS checker
Blocklist checker
Email tester
DMARC report XML analyzer
DMARC record generator
SPF record generator
DKIM record generator
Resources
Learn
Docs
Blog
Customers
How we compare
Contact
About

Suped

Privacy policy
Terms of service
© 2026 Suped Pty Ltd
LinkedInXFacebookInstagramThreadsYouTube