What TLS-RPT is for
TLS-RPT (SMTP TLS Reporting, RFC 8460) is the feedback channel for MTA-STS and DANE: sending servers that could not negotiate valid TLS when delivering to your domain, or failed the policy, send a JSON report once a day to the address given. Without TLS-RPT a broken MTA-STS policy goes unnoticed until mail stops arriving.
mailto or https
Reports go either by mail to a mailbox (mailto:) or by HTTPS POST to an endpoint (https:). For agencies a collection mailbox per client or a report service that renders the JSON files is practical. Several addresses can be listed separated by commas.
Publish and check
Publish the value as a TXT record under the name _smtp._tls. The record is valid independently of MTA-STS and can be set before the policy. Then use the TLS-RPT checker to confirm syntax and address.
Frequently asked questions
- Do reports arrive when nothing fails?
- Yes, Google and Microsoft send a daily report with the number of successful and failed connections as soon as they have delivered mail to the domain.
- Can the reporting address live in another domain?
- Yes, TLS-RPT requires no authorisation by the target domain, unlike DMARC.