Glossary

TLS-RPT (SMTP TLS Reporting)

Delivers daily reports on TLS failures during email delivery

TLS-RPT (SMTP TLS Reporting) is an email standard defined in RFC 8460 that enables domain owners to receive daily JSON reports from sending mail servers about failures and successes when establishing TLS-encrypted connections to deliver mail to their domain.

What is TLS-RPT?

TLS-RPT, or SMTP TLS Reporting, is specified in RFC 8460. It is a companion standard to MTA-STS and DANE (DNS-based Authentication of Named Entities) that provides visibility into TLS connection attempts made by sending mail servers when delivering email to your domain. Without TLS-RPT, TLS failures are silent — you have no way of knowing whether inbound email delivery is failing due to certificate errors or policy mismatches.

Domain owners publish a TLS-RPT policy as a DNS TXT record at "_smtp._tls.yourdomain.com." This record contains a "rua=" tag that specifies one or more email addresses or HTTPS endpoints where reports should be delivered. Sending mail servers that support TLS-RPT send a JSON report once per day for each policy domain they encounter.

TLS-RPT is particularly valuable during the deployment of MTA-STS because it reveals whether legitimate sending servers are encountering TLS errors that would cause delivery failures if the policy were set to "enforce" mode.

How Does TLS-RPT Work?

When a sending mail server with TLS-RPT support delivers mail to a domain that has published a TLS-RPT record, it tracks the outcome of each TLS connection attempt. At the end of a 24-hour reporting window, it compiles a JSON report summarising all connection results for that domain: the total number of successful TLS sessions, the number of failures, the type of failure (for example, certificate validation error, MX mismatch, or STARTTLS negotiation failure), and the policy that was in effect (MTA-STS or DANE).

The report is sent to the "rua=" address specified in the TLS-RPT DNS record. Reports can be delivered by email or via HTTP POST to an HTTPS endpoint. The JSON schema is standardised, allowing automated tools to parse and analyse reports across many sending servers.

TLS-RPT reports are analogous to DMARC aggregate reports in the email authentication world — they provide forensic data that helps operators identify and fix problems before they cause email loss.

How to Check Your TLS-RPT Record

You can verify that your TLS-RPT DNS record is correctly published using the TLS-RPT Checker at nslookup.net/tools/tls-rpt-checker. The tool queries the TXT record at "_smtp._tls.yourdomain.com," validates the syntax, and confirms that the "rua=" reporting address is correctly formatted.

After publishing your TLS-RPT record, allow 24 to 48 hours for the first reports to arrive. Major senders like Google and Microsoft will begin sending reports once they observe mail delivery to your domain.

Related Tool

TLS-RPT Checker

Try the Tool →

Frequently Asked Questions

Is TLS-RPT required if I am not using MTA-STS?

TLS-RPT is useful even without MTA-STS because it provides visibility into whether inbound email is actually being delivered over TLS. It also works with DANE policies. Even in the absence of a strict TLS policy, knowing whether sending servers are successfully establishing encrypted connections to your mail servers has independent security value.

What format are TLS-RPT reports delivered in?

TLS-RPT reports are delivered as JSON files, either attached to an email sent to the "rua=" address or posted to an HTTPS endpoint. The JSON schema is defined in RFC 8460 and includes fields for the policy domain, the reporting period, contact information for the reporting MTA, and an array of policy failure records with result types and affected message counts.

Which mail providers send TLS-RPT reports?

Major email providers including Google (Gmail and Workspace), Microsoft (Outlook and Exchange Online), and Yahoo Mail support sending TLS-RPT reports. Adoption is growing among email service providers and security-conscious operators. The reports you receive will vary depending on which senders are delivering mail to your domain.

Can I send TLS-RPT reports to a third-party service?

Yes. The "rua=" tag accepts both "mailto:" addresses and "https:" endpoints. Many email security platforms and reporting services accept TLS-RPT reports via HTTPS POST and provide dashboards for analysing the data. You can specify multiple destinations separated by commas to send reports to your own mailbox and a third-party analytics service simultaneously.