====== TLS-RPT (SMTP TLS Reporting) ======

**TLS-RPT** (SMTP TLS Reporting) is an email security standard specified in [[https://datatracker.ietf.org/doc/html/rfc8460|RFC 8460]] that enables domain owners to receive automated diagnostic reports regarding TLS encryption failures occurring when remote servers attempt to deliver email to their domain.

It works hand-in-hand with [[email:dns-configuration:mta-sts|MTA-STS]] and [[networking:dns:dnssec|DANE]], providing visibility into deliverability issues caused by expired certificates, cipher suite mismatches, or active Man-in-the-Middle (MitM) attacks.

----

===== How TLS-RPT Works =====

When a sending mail transfer agent (MTA) attempts an encrypted SMTP connection to your mail server:

  # **DNS Query:** The sending MTA queries DNS for a TXT record located at ''_smtp._tls.yourdomain.com''.
  # **Session Monitoring:** The sending MTA attempts to establish a secure connection based on your domain's [[email:dns-configuration:mta-sts|MTA-STS]] or DANE policy.
  # **Report Generation:** If a TLS handshake error, certificate expiration, or policy negotiation failure occurs, the sending server logs the details.
  # **Report Delivery:** The sending MTA aggregates these failure events into a JSON report and sends it daily to the email address or HTTPS endpoint specified in your TLS-RPT record.

----

===== TLS-RPT Record Structure & Syntax =====

A TLS-RPT record is published as a single DNS **TXT** record located at the host:
''_smtp._tls.yourdomain.com''

^ Tag ^ Required / Optional ^ Description ^ Example ^
| **v** | **Required** | Protocol version. Must be ''TLSRPTv1''. | ''v=TLSRPTv1;'' |
| **rua** | **Required** | Reporting URI(s) for aggregate reports. Supports email (''mailto:'') and HTTPS POST endpoints. | ''rua=mailto:tls-rpt@telenegar.ir'' |

==== Standard Example (Email Reporting) ====
<code>
v=TLSRPTv1; rua=mailto:tls-reports@telenegar.ir;
</code>

==== Advanced Example (Email + HTTPS Webhook) ====
<code>
v=TLSRPTv1; rua=mailto:tls-reports@telenegar.ir,https://tls-rpt.telenegar.ir/v1/submit;
</code>

----

===== What TLS Reports Contain =====

TLS-RPT reports are delivered as compressed JSON files (usually GZipped) containing summary details of connection attempts:

  * **Policy Details:** Which protocol was enforced (''mta-sts'', ''dane'', or ''no-policy-found'').
  * **Success & Failure Counts:** Number of successful TLS sessions vs. failed attempts.
  * **Failure Types:** Specific failure reasons, including:
    * ''certificate-expired''
    * ''certificate-host-mismatch''
    * ''validation-failure'' (CA untrusted)
    * ''starttls-not-supported''

==== Sample JSON Failure Excerpt ====
<code> json
{
  "organization-name": "Google Inc.",
  "date-range": {
    "start-datetime": "2026-08-02T00:00:00Z",
    "end-datetime": "2026-08-02T23:59:59Z"
  },
  "policies": [{
    "policy": {
      "policy-type": "sts",
      "policy-string": ["version: STSv1", "mode: enforce", "mx: mail.telenegar.ir"]
    },
    "summary": {
      "total-successful-session-count": 1240,
      "total-failure-session-count": 2
    },
    "failure-details": [{
      "result-type": "certificate-expired",
      "sending-mta-ip": "203.0.113.5",
      "receiving-mx-hostname": "mail.telenegar.ir",
      "failed-session-count": 2
    }]
  }]
}
</code>

----

===== Why Implement TLS-RPT? =====

  * **Visibility into TLS Failures:** Without TLS-RPT, when an MTA-STS policy fails in ''enforce'' mode, incoming emails are silently dropped without notifying domain admins.
  * **Detect Active Attacks:** Identifies downgrade attacks or network interception attempts on your inbound mail traffic.
  * **Monitor Certificate Expirations:** Detects when your mail server's SSL/TLS certificate expires before critical mail flow is disrupted.

----

===== Verification & Testing =====

You can verify your TLS-RPT record using **Telenegar Tools** or terminal commands:

==== Using Telenegar Tools ====
  * **DNS Lookup:** Verify that your ''_smtp._tls'' TXT record resolves globally with the [[tools:dnscheck|Telenegar DNS Check Tool]].
  * **Email Diagnostics:** Audit your full email security stack (SPF, DKIM, DMARC, MTA-STS, TLS-RPT) with the [[tools:mailcheck|Telenegar Mail Check Tool]].

==== Using Terminal Commands ====

=== dig (Linux / macOS) ===
<code> bash
dig +short TXT _smtp._tls.example.com
</code>

=== nslookup (Windows / Cross-platform) ===
<code> cmd
nslookup -type=TXT _smtp._tls.example.com
</code>

----

===== Related Documentation =====

  * [[tools:dnscheck|Telenegar DNS Check Tool]] — Diagnostic tool for DNS record lookup and propagation.
  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email authentication and encryption health.
  * [[email:dns-configuration:mta-sts|MTA-STS]] — Enforce TLS encryption requirements for incoming mail.
  * [[email:dns-configuration:dmarc|DMARC]] — Receive email authentication failure reports.
  * [[email:dns-configuration:mx-records|MX Records]] — Configure mail exchanger targets for your domain.