TLS-RPT (SMTP TLS Reporting), defined in RFC 8460, gives domain owners visibility into how well encrypted mail delivery is working. Sending servers that support it collect statistics on successful and failed TLS sessions and send periodic reports to an address you nominate.
You enable it with a single TXT record at _smtp._tls.<domain> containing v=TLSRPTv1 and a rua= destination, which can be a mailto: address or an https: endpoint. Reports arrive as JSON, typically once a day, summarising delivery attempts and any problems such as certificate validation failures, expired certificates, or a STARTTLS downgrade.
TLS-RPT is the feedback channel for MTA-STS and DANE. Without it you would enforce a strict TLS policy blind, with no way to learn that legitimate senders were being turned away. Reviewing the reports during the MTA-STS testing phase is the safest way to confirm a policy is correct before switching to enforce.
It does not protect against spoofing; that is the job of DMARC. TLS-RPT only concerns the confidentiality of mail in transit. Use the checker below to verify your record is published and well-formed.
Check it on your domain
- TLS-RPT Checker: validates the TLS-RPT reporting record.
- MTA-STS Checker: checks the MTA-STS record and the hosted policy file.
- TXT Record Checker: looks up the TXT records on a host name.