Build an MTA-STS policy
Two things that must agree: a DNS record and a policy file. This builds both, with an id that changes whenever you regenerate.
Judged against RFC 8461 section 3
_mta-sts.yourcompany.com
TXT
v=STSv1; id=202608131322
version: STSv1 mode: testing mx: mail.yourcompany.com max_age: 604800
Publish the policy file first and confirm it loads with no redirect. The DNS record tells senders to go looking for it.
Before you publish
A generator gives you correct syntax. It cannot know your senders, and syntax was never the hard part. Every record here is easy to write and easy to get subtly wrong in a way that blocks real mail rather than forged mail.
Publish the least strict version first, run the full checkup against your domain, and tighten only once you can see what the change did. If mail is business-critical and you are unsure, that is exactly the sort of thing worth a second opinion.
Questions people actually ask
Does this change my DNS?
No. Nothing here touches your domain, and nothing you type is sent anywhere, the record is built in your browser. You copy it and publish it yourself, which is the only way a tool should ever work.
Where do I paste the record?
Into your DNS provider, as a TXT record, using the host and value shown. Some panels want the host without your domain on the end, and some want it with, if one fails, try the other form.
How long until it works?
As long as the TTL on the record, usually an hour or less for a new one. Check it with the full checkup afterwards rather than assuming.
Should I publish this straight to production?
For reporting-only records, yes. For anything that changes how mail is treated, start with the least strict setting the form offers and tighten once you have seen the reports.
Related tests
Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.