Mail transport & reputation
What is TLS-RPT? SMTP TLS Reporting explained
TLS-RPT makes large mail providers send you daily reports on whether encrypted deliveries to your domain succeeded or failed.
How TLS-RPT works
The record is a TXT record at _smtp._tls.<domain> with a report address (rua), usually an email address. Providers such as Google and Microsoft send a JSON report there once a day.
The report shows how many connections were successfully encrypted and which errors occurred – for example an expired certificate, an MTA-STS policy that does not match the MX, or a wrong DANE record.
Without TLS-RPT you only notice such problems when mail stops arriving. That is why TLS-RPT belongs to every rollout of MTA-STS or DANE.
Example
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"Reports arrive as compressed JSON files; reporting services summarise them clearly.
Common mistakes
- The report address does not exist or filters the attachments as spam.
- The record sits at _smtp.<domain> instead of _smtp._tls.<domain>.
- Reports are received but never read.
How the Domain Trust Check rates TLS-RPT
Criterion “TLS-RPT” (weight 4 of 5): TLS-RPT record at _smtp._tls with a valid report address (rua), so Gmail, Microsoft and others report failed encrypted deliveries.
Standard: RFC 8460