TLS-RPT reporting record

Where receiving servers send their reports about failed TLS deliveries to this domain. Optional, and only useful alongside MTA-STS.

• Help center

TLS-RPT (SMTP TLS Reporting, RFC 8460) asks sending mail servers to tell you when they had trouble establishing an encrypted connection to your domain: an expired or mismatched certificate on an MX host, a failed STARTTLS, a policy they could not fetch. Large senders such as Google and Microsoft send a daily JSON summary to the address you publish.

Without it, TLS problems on inbound mail are invisible: messages are either delivered unencrypted or, under an enforced MTA-STS policy, not delivered at all, and nobody tells you.

How SiteScan checks

The row appears only for domains with MX records. The scan looks for a TXT record at _smtp._tls.example.com starting with v=TLSRPTv1. It is optional and most useful alongside MTA-STS, so a missing record is shown as a neutral fact.

How to set it up

Add one TXT record:

_smtp._tls.example.com TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

Use a dedicated mailbox or a reporting service, because the reports are machine-readable and arrive every day from each large sender. You can list several destinations separated by commas, including an https:// endpoint. More in email authentication.