TLS-RPT Generator
Generate a SMTP TLS reporting DNS record to receive TLS failure reports.
Frequently Asked Questions
What is TLS-RPT?
TLS-RPT (TLS Reporting, RFC 8460) allows domain owners to receive daily reports about TLS connection failures experienced by sending mail servers when delivering email to their domain. Reports are sent to an email address or HTTPS endpoint specified in a TXT record at _smtp._tls.yourdomain.com. TLS-RPT is designed to work alongside MTA-STS and DANE to give visibility into mail delivery failures caused by TLS configuration problems.
What format does a TLS-RPT report use?
TLS-RPT reports are JSON files (often gzip-compressed and sent as email attachments) covering a 24-hour reporting period. Each report includes: the reporting organisation, the period covered, the policies applied (MTA-STS or DANE), and summary statistics including successful connections, failure counts, and failure types (certificate expired, hostname mismatch, TLS negotiation failure, MTA-STS policy violation, etc.). Major providers like Google and Microsoft send TLS-RPT reports.
How do I set up TLS-RPT?
Publish a DNS TXT record at _smtp._tls.yourdomain.com with the value: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com. Replace the email with one you control. You can also use an HTTPS endpoint: rua=https://reports.example.com/tls. Reports are sent once per 24-hour period by participating senders. TLS-RPT is low-risk to deploy — it only generates reports and does not affect mail flow.
Do I need MTA-STS to use TLS-RPT?
No — TLS-RPT can be deployed independently of MTA-STS. It also works with DANE, or simply provides visibility into generic TLS failures even without a strict policy. However, TLS-RPT is most valuable in combination with MTA-STS or DANE, as it tells you whether your policy is causing delivery problems before or after switching to enforce mode. Publishing TLS-RPT is a safe, low-risk first step toward improving your mail security posture.