Build a TLS-RPT record
One record, one destination, and the feedback you need before turning MTA-STS to enforce.
Judged against RFC 8460 section 3
_smtp._tls.yourcompany.com
TXT
v=TLSRPTv1; rua=mailto:tlsrpt@yourcompany.com
Before you publish
A generator gives you correct syntax. It cannot know your senders, and syntax was never the hard part. Every record here is easy to write and easy to get subtly wrong in a way that blocks real mail rather than forged mail.
Publish the least strict version first, run the full checkup against your domain, and tighten only once you can see what the change did. If mail is business-critical and you are unsure, that is exactly the sort of thing worth a second opinion.
Questions people actually ask
Does this change my DNS?
No. Nothing here touches your domain, and nothing you type is sent anywhere, the record is built in your browser. You copy it and publish it yourself, which is the only way a tool should ever work.
Where do I paste the record?
Into your DNS provider, as a TXT record, using the host and value shown. Some panels want the host without your domain on the end, and some want it with, if one fails, try the other form.
How long until it works?
As long as the TTL on the record, usually an hour or less for a new one. Check it with the full checkup afterwards rather than assuming.
Should I publish this straight to production?
For reporting-only records, yes. For anything that changes how mail is treated, start with the least strict setting the form offers and tighten once you have seen the reports.
Related tests
Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.