CloudFlare Worker for MTA-STS policy

mta-sts.js

// const mode = 'testing';
const mode = 'enforce';

// const max_age = 86400; // 1 day
const max_age = 604800; // 1 week

const mx_list = [
  'aspmx.l.google.com',
  'alt1.aspmx.l.google.com',
  'alt2.aspmx.l.google.com',
  'alt3.aspmx.l.google.com',
  'alt4.aspmx.l.google.com',
];

const sts = `version: STSv1
mode: ${mode}
${mx_list.map(i=> 'mx: '+ i).join('\n')}
max_age: ${max_age}`;

export default{
  async fetch() {
    return new Response(sts);
  },
};

And add an A record to be able to route the traffic to this worker:

• Type: A
• Name: mta-sts
• IPv4 address: 192.0.2.1
• Proxy status: On (this is important!)
• TTL: Auto

To be clear, you don't need an A record. And this could be dangerous.

Just use a route instead. mta-sts.*/.well-known/mta-sts.txt