TLS-RPT (SMTP TLS Reporting)

TLS-RPT (SMTP TLS Reporting) is an email security standard specified in RFC 8460 that enables domain owners to receive automated diagnostic reports regarding TLS encryption failures occurring when remote servers attempt to deliver email to their domain.

It works hand-in-hand with MTA-STS and DANE, providing visibility into deliverability issues caused by expired certificates, cipher suite mismatches, or active Man-in-the-Middle (MitM) attacks.

When a sending mail transfer agent (MTA) attempts an encrypted SMTP connection to your mail server:

# **DNS Query:** The sending MTA queries DNS for a TXT record located at ''_smtp._tls.yourdomain.com''.
# **Session Monitoring:** The sending MTA attempts to establish a secure connection based on your domain's [[email:dns-configuration:mta-sts|MTA-STS]] or DANE policy.
# **Report Generation:** If a TLS handshake error, certificate expiration, or policy negotiation failure occurs, the sending server logs the details.
# **Report Delivery:** The sending MTA aggregates these failure events into a JSON report and sends it daily to the email address or HTTPS endpoint specified in your TLS-RPT record.

A TLS-RPT record is published as a single DNS TXT record located at the host: _smtp._tls.yourdomain.com

v=TLSRPTv1; rua=mailto:tls-reports@telenegar.ir;

v=TLSRPTv1; rua=mailto:tls-reports@telenegar.ir,https://tls-rpt.telenegar.ir/v1/submit;

TLS-RPT reports are delivered as compressed JSON files (usually GZipped) containing summary details of connection attempts:

• Policy Details: Which protocol was enforced (mta-sts, dane, or no-policy-found).
• Success & Failure Counts: Number of successful TLS sessions vs. failed attempts.
• Failure Types: Specific failure reasons, including:
  • certificate-expired
  • certificate-host-mismatch
  • validation-failure (CA untrusted)
  • starttls-not-supported

 json
{
  "organization-name": "Google Inc.",
  "date-range": {
    "start-datetime": "2026-08-02T00:00:00Z",
    "end-datetime": "2026-08-02T23:59:59Z"
  },
  "policies": [{
    "policy": {
      "policy-type": "sts",
      "policy-string": ["version: STSv1", "mode: enforce", "mx: mail.telenegar.ir"]
    },
    "summary": {
      "total-successful-session-count": 1240,
      "total-failure-session-count": 2
    },
    "failure-details": [{
      "result-type": "certificate-expired",
      "sending-mta-ip": "203.0.113.5",
      "receiving-mx-hostname": "mail.telenegar.ir",
      "failed-session-count": 2
    }]
  }]
}

• Visibility into TLS Failures: Without TLS-RPT, when an MTA-STS policy fails in enforce mode, incoming emails are silently dropped without notifying domain admins.
• Detect Active Attacks: Identifies downgrade attacks or network interception attempts on your inbound mail traffic.
• Monitor Certificate Expirations: Detects when your mail server's SSL/TLS certificate expires before critical mail flow is disrupted.

You can verify your TLS-RPT record using Telenegar Tools or terminal commands:

• DNS Lookup: Verify that your _smtp._tls TXT record resolves globally with the Telenegar DNS Check Tool.
• Email Diagnostics: Audit your full email security stack (SPF, DKIM, DMARC, MTA-STS, TLS-RPT) with the Telenegar Mail Check Tool.

 bash
dig +short TXT _smtp._tls.example.com

 cmd
nslookup -type=TXT _smtp._tls.example.com

• Telenegar DNS Check Tool — Diagnostic tool for DNS record lookup and propagation.
• Telenegar Mail Check Tool — Diagnostic tool for email authentication and encryption health.
• MTA-STS — Enforce TLS encryption requirements for incoming mail.
• DMARC — Receive email authentication failure reports.
• MX Records — Configure mail exchanger targets for your domain.