Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

TLS-RPT

SMTP TLS Reporting: a DNS record asking sending servers to send daily reports about failures to establish a secure connection to a domain's mail servers. Defined in RFC 8460.

Sumit Raj · reviewed

SMTP TLS Reporting. The visibility half of transport security.

A TXT record at _smtp._tls.<domain> names an address for daily reports. Sending servers use it to tell you when they could not establish a secure connection to your mail servers, including why: an expired certificate, a name that did not match, a failed STARTTLS negotiation, or an MTA-STS policy they could not satisfy.

It changes nothing about how mail is handled. Its entire value is that TLS failures are otherwise completely invisible to the receiving domain: the sender either falls back to plaintext or gives up, and nobody tells you either happened.

Publishing MTA-STS without TLS-RPT means enforcing a policy you cannot see the effects of.

Related

  • MTA-STSSMTP MTA Strict Transport Security: a policy published over HTTPS and announced in DNS that tells sending servers to require TLS and to accept only named mail exchangers for a domain. Defined in RFC 8461.
  • DANEDNS-Based Authentication of Named Entities: a TLSA record in DNSSEC-signed DNS that states which certificate a mail server must present, removing reliance on public certificate authorities. Defined in RFC 6698 and RFC 7672 for SMTP.
  • TLS-RPT TestAre TLS failures being reported to anyone, or happening in silence?
  • TLS-RPT GeneratorBuild the record that gets TLS failures reported to you.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.