TLS-RPT (SMTP TLS Reporting, RFC 8460) is a DNS TXT record that asks other mail servers to send you reports about problems they had setting up encrypted TLS connections when delivering email to your domain. The record lives at _smtp._tls under your domain and names a report address with rua=.
Why it matters
Encryption failures between mail servers are invisible to you. A certificate may have expired, a server may be misconfigured, or an attacker may be interfering, and the only sign is mail that arrives late or not at all. TLS-RPT gives you daily summaries from senders that support it. That makes it the safety net for MTA-STS: you can run a policy in testing mode and see what would have failed before you enforce anything.
How to do it
- Create a mailbox or alias for the reports, such as
tls-reports@example.com. - Publish a TXT record at
_smtp._tlson your domain:
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"
- You can instead give an HTTPS endpoint. This is useful when a reporting service collects the data for you:
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=https://reports.example.net/tlsrpt"
- Wait for reports. They are sent by supporting senders, usually once a day, as JSON files, often compressed. A report viewer makes them easier to read.
- Look for the failure types in each report, such as a certificate that does not match the host name or a server that does not offer TLS. Fix the cause on the mail server side.
- Combine TLS-RPT with MTA-STS. The whole process is covered in the MTA-STS and TLS-RPT guide.
To confirm the record is live, run dig TXT _smtp._tls.example.com +short and check that the answer begins with v=TLSRPTv1.
Crawvix's scan checks "TLS reporting (TLS-RPT) is set up" for your domain.
Common mistakes
- Publishing the record at the bare domain instead of
_smtp._tls. - Using an address without the
mailto:prefix. - Pointing reports at a personal inbox that will fill up.
- Expecting reports from every sender. Only servers that support TLS-RPT send them.
- Setting up TLS-RPT but never opening the reports.
Frequently asked questions
Is TLS-RPT only for MTA-STS?
No. RFC 8460 also covers reporting for DANE, another way of requiring TLS. In practice most people pair it with MTA-STS.
Does TLS-RPT change how mail is delivered?
No. It only requests reports. It does not block or reroute any messages.
How often do reports arrive?
Senders that support it typically send a summary once per day. The schedule is the sender's choice, so a new record can take a day or more to show results.
Related guides
Want to see whether your domain publishes it? Try the free website sample.