TLS-RPT Explained

TLS* Reporting (TLS-RPT) is an email security standard that tells sending mail servers where to report problems they encounter when delivering email to your domain over TLS.

It does not authenticate messages like SPF, DKIM, or DMARC. Instead, it gives you visibility into failed TLS connections, invalid certificates, and MTA-STS policy failures that may prevent email from reaching your inboxes.

TLS-RPT is published as a DNS TXT record at _smtp._tls.example.com.

The v=TLSRPTv1 tag identifies the protocol. The rua= tag specifies one or more destinations for aggregate reports. Destinations can be an email address using mailto: or an HTTPS endpoint that accepts TLS-RPT reports (JSON).

TLS-RPT is most useful alongside MTA-STS. MTA-STS tells senders to require TLS and validate the destination mail server. TLS-RPT lets those senders report when the policy cannot be met.