Simplify MTA-STS with hosted MTA-STS

Enforce TLS for mail delivery with two CNAME records. Manage policy and MX hosts in a dashboard. No web hosting required.

Get started

Trusted by 1,000+ companies

Hosted MTA-STS

Complete hosted MTA-STS solution

Hosted MTA-STS provides a dashboard-based interface for managing your MTA-STS policy instead of hosting a policy file yourself. Add two CNAME records once, then manage policy mode, max age, and MX hosts through the dashboard. No web hosting or certificate configuration required.

Hosted MTA-STS

Managed TLS policy

Enforce

Policy file preview

version: STSv1
mode: enforce
mx: smtp.google.com
max_age: 86400

MX hosts

smtp.google.com

DNS records

2 CNAMEs

Status

Verified

TLS enforcement

Secure mail delivery by default

MTA-STS tells sending servers to use TLS when delivering to your MX hosts. Hosted MTA-STS lets you choose enforce mode so mail is only accepted over encrypted connections, protecting against downgrade attacks.

No web hosting

Two CNAME records only

Traditional MTA-STS requires hosting a policy file on HTTPS. With hosted MTA-STS, add two CNAME records pointing to Suped and we host both the policy file and the DNS record for you. No web server or certificate setup needed.

Dashboard management

Update policy without DNS edits

Change your MTA-STS policy, max age, or MX hosts through a simple dashboard. No more editing text files or redeploying. Updates take effect as soon as you save, with no additional DNS changes required.

Policy modes

Testing before enforce

Start with testing mode to validate your configuration without affecting mail delivery. Once you confirm everything works, switch to enforce mode for full TLS protection.

Delegated authority

Manage MTA-STS without DNS access

Allow your IT or Security team to configure and update MTA-STS without needing administrative access to your DNS provider. Add the two CNAME records once, then all policy changes, including switching from testing to enforce mode, happen through the dashboard with no further DNS edits.