What is TLS-RPT?

TLS-RPT is the standard that gives you visibility into how securely your email is actually being delivered. Its full name is SMTP TLS Reporting, and it works by asking the mail servers that send to your domain to send you back a daily summary of their connection attempts, including any that failed to set up proper encryption. Where MTA-STS enforces secure delivery, TLS-RPT tells you whether that enforcement is working and warns you the moment something breaks.

What problem does TLS-RPT solve?

Email encryption between servers happens quietly in the background, which means when it fails, you usually have no idea. A misconfigured certificate, an expired policy or an attacker stripping encryption can all cause mail to be delivered insecurely or not at all, with no alert to you. TLS-RPT fixes this blind spot. By publishing a TLS-RPT record, you ask senders to report what they saw, turning invisible delivery problems into a daily feed you can act on.

How TLS-RPT works

TLS-RPT is published as a single DNS TXT record on the host _smtp._tls under your domain. The record names an address, an email box or an HTTPS endpoint, where reports should be sent. Sending servers that support the standard gather statistics over each day and deliver a structured report to that address. The report shows how many connections succeeded with secure encryption and how many failed, along with the reason for each failure.

What the reports tell you

• Successful sessions, confirming that most senders are reaching you over proper encryption.
• Certificate problems, such as an expired or mismatched certificate on your mail server.
• Policy failures, where a sender could not validate your MTA-STS policy or DANE records.
• Downgrade attempts, where encryption could not be negotiated at all, which may signal an attack or a broken configuration.

Reading these regularly means you learn about a delivery problem from a report, not from a customer telling you their message bounced.

TLS-RPT and MTA-STS

TLS-RPT and MTA-STS are designed to be deployed as a pair. MTA-STS is the policy that requires secure delivery, and TLS-RPT is the feedback loop that shows whether senders can meet it. The recommended approach is to publish both, start MTA-STS in testing mode, and use the TLS-RPT reports to confirm that everything works before switching MTA-STS to enforce. Our guide on what MTA-STS is explains the enforcement side in detail.

How to set up TLS-RPT

Setting up TLS-RPT is the simplest of the email security records. You publish one DNS TXT record on _smtp._tls with a version tag and a destination for the reports. Because reports arrive in a structured format, most teams point them at a service that parses and summarises them rather than reading the raw files by hand. Once the record is live, reports begin arriving within a day or two from the larger mail providers.

Is TLS-RPT worth setting up?

For the effort involved, TLS-RPT offers an unusually good return. It is a single DNS record with no enforcement risk of its own, because it never blocks or changes mail; it only asks senders to tell you what happened. That means there is no downside to publishing it and a clear upside: you gain a daily, provider-level view of whether your inbound email is being encrypted properly. Without it, the first sign of a broken certificate or a failing MTA-STS policy is often a missed message or a customer complaint, by which point mail may have been flowing insecurely for days. With it, the same problem shows up in a report the next morning, while it is still small. TLS-RPT is especially valuable in the window when you are rolling out MTA-STS, because the reports are what give you the confidence to move from testing to enforce. For any domain that takes email security seriously, it belongs in the standard set of records right next to SPF, DKIM, DMARC and MTA-STS.

How to check TLS-RPT

A TLS-RPT record is easy to mistype or forget entirely, which leaves you without the visibility it is meant to provide. Run a security scan with EzyAudit AI and you will see whether TLS-RPT is published and valid, alongside MTA-STS and the rest of your DNS and email security, explained in plain language. Review the full list of checks we run. For the formal specification, TLS-RPT is defined in IETF RFC 8460.

TLS-RPT turns the security of your email delivery from guesswork into something you can measure and monitor. Scan your website now to see whether TLS-RPT and the rest of your email records are in place.