[ Quick answer ]
TLS-RPT (SMTP TLS Reporting) is a DNS TXT record that asks sending mail servers to send you daily reports about TLS connection failures when delivering to your domain. It is defined in RFC 8460 and is used alongside MTA-STS and DANE.
Key facts
- ›Record: _smtp._tls.yourdomain.com TXT v=TLSRPTv1; rua=mailto:tls@yourdomain.com.
- ›Reports are JSON, usually gzip compressed, sent daily.
- ›Reports show successful and failed sessions and failure types.
Reviewed 2026-11-02 · EmailAuth research team
TLS-RPT (RFC 8460) asks sending providers such as Google and Microsoft to email you a daily JSON summary of TLS sessions to your mail servers, including failures caused by expired certificates, MTA-STS policy mismatches or downgrade attempts.
The TLS-RPT record
- Host: _smtp._tls.yourdomain.com
- Type: TXT
- Value: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com
What reports contain
- Policy type applied (MTA-STS, DANE or none).
- Counts of successful and failed sessions.
- Failure types such as certificate-expired or starttls-not-supported.
Frequently asked questions
What is TLS-RPT?
A reporting standard that tells you when other servers fail to establish encrypted connections to your mail servers.
Do I need TLS-RPT if I have MTA-STS?
Yes. Without TLS-RPT you will not know when MTA-STS enforcement is blocking or failing delivery.
How do I check my TLS-RPT record?
Use an MTA-STS and TLS-RPT checker to confirm _smtp._tls.yourdomain.com exists and has a valid rua address.
[ TLS-RPT guide ]
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.