What Is TLS-RPT? SMTP TLS Reporting Explained

TLS-RPT (SMTP TLS Reporting) is a DNS-based mechanism that allows domain owners to receive reports about email delivery issues related to TLS encryption.

It provides visibility into whether messages are successfully delivered over secure connections and highlights failures such as certificate errors or policy mismatches.

TLS-RPT is particularly valuable when deploying MTA-STS, as it helps identify real-world delivery issues that would otherwise be invisible.

You can check your TLS-RPT record with the DNS Pro TLS-RPT Check tool.

For comparison, you can also use MXToolbox: https://mxtoolbox.com/TLSRPTLookup.aspx

TLS-RPT is published as a TXT record under a specific subdomain: _smtp._tls.yourdomain.com.

Example record:

_smtp._tls.example.com. 3600 IN TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

• _smtp._tls.example.com → fixed hostname for TLS-RPT policies
• 3600 → TTL (cache duration in seconds)
• TXT → record type
• v=TLSRPTv1 → identifies the record as TLS-RPT
• rua=mailto:tls-reports@example.com → destination for aggregate reports

TLS-RPT uses a simple tag-based format:

• v → version (must be TLSRPTv1)
• rua → reporting URI(s), typically mailto addresses
• Multiple rua values can be specified as a comma-separated list

v=TLSRPTv1; rua=mailto:reports@example.com,mailto:security@example.com

SMTP delivery failures related to TLS are often silent. Without reporting, it can be difficult to detect misconfigurations or downgrade attacks.

TLS-RPT provides aggregate reports that show:

• Failed TLS negotiations
• Certificate validation errors
• Policy mismatches (e.g. MTA-STS enforcement failures)
• Delivery attempts downgraded to plaintext

TLS-RPT does not enforce encryption policies itself. Instead, it reports on whether delivery met expectations.

MTA-STS defines the policy (e.g. require TLS), while TLS-RPT provides feedback on whether that policy is being honoured.

Learn more about MTA-STS here: /articles/what-is-mta-sts

• The record exists at _smtp._tls.yourdomain.com
• The version tag is exactly v=TLSRPTv1
• The rua address is valid and monitored
• Multiple reporting destinations are correctly formatted
• The domain also has MTA-STS configured if enforcement is required

• Publishing the record at the root domain instead of _smtp._tls
• Incorrect tag formatting or missing semicolons
• Assuming TLS-RPT enforces policy rather than reports
• Configuring reporting but not monitoring the mailbox
• Using invalid or unreachable mailto addresses

# Query TLS-RPT record
dig TXT _smtp._tls.example.com

# Alternative
nslookup -type=txt _smtp._tls.example.com

If you want to validate this topic in practice, these DNS Pro tools are the fastest next step.

• TLS-RPT Check
• MTA-STS Check
• Email Security Check