Host MTA-STS policies with Cloudflare Workers

MTA-STS tells other mail servers to deliver to you only over verified TLS, and it needs two pieces: a _mta-sts TXT record in DNS and a policy file served over HTTPS at mta-sts.yourdomain. A Cloudflare Worker on that hostname can return the policy file directly, with Cloudflare handling the certificate, which makes it one of the lightest ways to host MTA-STS.

The policy has to list your real MX hosts, and getting the mode, hostnames or certificate wrong can delay mail, so start in testing mode and move to enforce once reports look clean. The EmailAuth AI Agent reads your live MX and MTA-STS records, drafts the policy file and Worker response for you, and checks it once it is published. Start with your domain below, or book a free call with an EmailAuth engineer.

To get specific help for Host MTA-STS policies with Cloudflare Workers, engage with our EmailAuth AI Agent. It reads your domain's live DNS, checks what is already in place, and gives you ready-to-paste records or walks you through each step.

Open the EmailAuth AI Agent

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Transport security