TLS-RPT

TLS-RPT is a reporting standard that lets a recipient domain request reports about problems sending systems encounter when trying to deliver email using TLS, which protects connections between mail servers. The reports can help an email operator discover certificate, connection, or policy problems affecting mail delivery.

How does a domain request TLS reports?

The domain publishes a DNS TXT record at a name beginning with _smtp._tls, such as _smtp._tls.example.com. The record identifies the report format and one or more destinations. Sending mail systems that support TLS-RPT can send reports grouping together their connection attempts to those destinations, using email or HTTPS as specified by the reporting mechanism.

For example, an organization enables MTA-STS to require TLS with verified server identities for its incoming mail and publishes a TLS-RPT destination. If a sender cannot connect securely to a receiving mail server listed in MX records, its report may show the affected host, failure category, and counts. This gives the recipient domain information to investigate a configuration problem or a possible attempt to reduce connection security.

TLS-RPT reports are not sent by every mail system, do not necessarily include every delivery attempt, and may arrive later as summaries. TLS-RPT itself does not encrypt email or force a sender to use TLS; it reports on compatible senders' results. MTA-STS or DANE, another standard for securing connections, can specify connection requirements.

Related terms

• MTA-STS — can define secure SMTP transport policy
• TLS — encrypts and authenticates a mail-server connection
• MX record — identifies recipient mail servers
• Email provider — may process incoming reports