Question 1

What is TLS-RPT?

Accepted Answer

TLS-RPT (RFC 8460) is a DNS TXT record published at _smtp._tls.yourdomain.com that tells remote mail servers where to send reports about TLS negotiation failures when delivering email to your domain.

Question 2

Do I need MTA-STS or DANE for TLS-RPT to work?

Accepted Answer

No. While TLS-RPT was designed alongside MTA-STS, any mail server that supports reporting will send reports about STARTTLS failures even without MTA-STS or DANE. You'll receive reports about certificate errors, handshake failures, and policy mismatches.

Question 3

What format are TLS-RPT reports?

Accepted Answer

Reports are JSON documents (application/tlsrpt+json or gzipped) sent daily by email to the address specified in your rua tag. They contain details about successful and failed TLS connections including failure reasons and counts.

Question 4

How do I set up TLS-RPT?

Accepted Answer

Add a TXT record at _smtp._tls.yourdomain.com with the value: v=TLSRPTv1; rua=mailto:your-address@example.com. Reports will start arriving within 24-48 hours.