TLS-RPT

TLS-RPT (SMTP TLS Reporting) is a DNS TXT record that tells other mail servers where to send reports summarizing TLS connection failures when they tried to deliver mail to the domain — including failures related to an MTA-STS policy the domain has published (defined in RFC 8461), and is itself a Proposed Standard per its entry on the IETF Datatracker. NIST’s Trustworthy Email guidance added TLS Reporting to its recommendations in Revision 1, alongside MTA-STS, as newly specified email protocol security additions. Google Workspace’s help page About MTA-STS and TLS reporting describes the same exchange from the receiving domain’s side: turning on TLS reporting requests daily reports from external mail servers about any connection problems they find when sending mail to that domain. Without TLS-RPT, a domain enforcing MTA-STS has no visibility into legitimate senders whose mail is silently being deferred or rejected because they couldn’t establish a compliant TLS connection, which makes rolling out strict TLS requirements risky without reporting to catch problems early. TLS-RPT is usually deployed alongside MTA-STS rather than on its own, and is defined in RFC 8460.

AdminKit’s TLS-RPT check reads a domain’s live _smtp._tls record and reports whether it is published and has a working rua report destination, rather than just explaining the record in the abstract. See the best free TLS-RPT checkers roundup for how that check compares with other free TLS-RPT tools.

AdminKit groups tLS-RPT under its email authentication cluster — browse the AdminKit glossary index for other related terms.