diff --git a/src/app/Http/Controllers/WellKnownController.php b/src/app/Http/Controllers/WellKnownController.php
new file mode 100644
index 00000000..72e40af8
--- /dev/null
+++ b/src/app/Http/Controllers/WellKnownController.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Validator;
+
+class WellKnownController extends Controller
+{
+    /**
+     * Return the mtaSts policy
+     *
+     * @return \Illuminate\Http\Response The response
+     */
+    public function mtaSts()
+    {
+        $data = <<<EOF
+        version: STSv1
+        mode: enforce
+        mx: mx01.kolabnow.com
+        mx: mx02.kolabnow.com
+        mx: mx03.kolabnow.com
+        max_age: 604800
+        EOF;
+
+        return response()->json($data, 200);
+    }
+}
diff --git a/src/routes/web.php b/src/routes/web.php
index 7aed7a93..e27a07c5 100644
--- a/src/routes/web.php
+++ b/src/routes/web.php
@@ -1,62 +1,71 @@
 <?php
 
 use App\Http\Controllers;
 use Illuminate\Support\Facades\Route;
 
 Route::get('204', function () {
     return response()->noContent();
 });
 
 // We can handle every URL with the default action because
 // we have client-side router (including 404 error handler).
 // This way we don't have to define any "deep link" routes here.
 Route::group(
     [
         //'domain' => \config('app.website_domain'),
     ],
     function () {
         Route::get('content/page/{page}', Controllers\ContentController::class . '@pageContent')
             ->where('page', '(.*)');
         Route::get('content/faq/{page}', Controllers\ContentController::class . '@faqContent')
             ->where('page', '(.*)');
 
         Route::fallback(
             function () {
                 // Return 404 for requests to the API end-points that do not exist
                 if (strpos(request()->path(), 'api/') === 0) {
                     return Controllers\Controller::errorResponse(404);
                 }
 
                 $env = \App\Utils::uiEnv();
                 return view($env['view'])->with('env', $env);
             }
         );
     }
 );
 
 Route::group(
     [
         'prefix' => 'oauth'
     ],
     function () {
         // We manually specify a subset of endpoints from https://github.com/laravel/passport/blob/11.x/routes/web.php
         // after having disabled automatic routes via Passport::ignoreRoutes()
         Route::post('/token', [
             'uses' => '\Laravel\Passport\Http\Controllers\AccessTokenController@issueToken',
             'as' => 'token',
             // 'middleware' => 'throttle',
         ]);
 
         Route::middleware(['web', 'auth'])->group(function () {
             Route::get('/tokens', [
                 'uses' => '\Laravel\Passport\Http\Controllers\AuthorizedAccessTokenController@forUser',
                 'as' => 'tokens.index',
             ]);
 
             Route::delete('/tokens/{token_id}', [
                 'uses' => '\Laravel\Passport\Http\Controllers\AuthorizedAccessTokenController@destroy',
                 'as' => 'tokens.destroy',
             ]);
         });
     }
 );
+
+Route::group(
+    [
+        'prefix' => '.well-known'
+    ],
+    function () {
+        Route::get('/mta-sts.txt', [Controllers\WellKnownController::class, "mtaSts"]);
+    }
+);