TLS-RPT (RFC 8460) is the reporting sidekick to MTA-STS and DANE. You publish a TXT record naming a mailbox or HTTPS endpoint that should receive daily aggregate reports of TLS failures on inbound SMTP.
Record Format
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:[email protected]"What the Reports Contain
JSON documents listing:
- Total sessions attempted per sending domain
- Successful vs failed TLS negotiations
- Failure types:
starttls-not-supported,certificate-host-mismatch,certificate-expired,certificate-not-trusted,dane-required-but-not-enabled
Why It Matters
MTA-STS enforcement without visibility is dangerous — you don’t know if a sender’s mail is being rejected because your MTA-STS policy is too strict, or because their MX has a broken cert. TLS-RPT gives you the daily visibility to catch policy misconfigurations before they cost you mail.
Common Miss
Publishing MTA-STS without TLS-RPT. Fix by adding both TXT records together.
Related
Check the MTA-STS glossary entry, read what DMARC is, and see how to read a DMARC report.