ConfiguRadar

TLS-RPT checker

Validates the record that asks sending servers to tell you when TLS negotiation to your mail servers fails.

What TLS reporting is for

When a sending server cannot negotiate TLS with your mail servers, perhaps an expired certificate, a downgrade or a policy mismatch, you would normally never find out. TLS-RPT asks senders to send you a daily summary of those failures. It changes nothing about delivery; it makes an invisible failure mode visible.

It is most useful alongside MTA-STS: reports are how you discover that enforcing your policy would break delivery, before you enforce it.

What this checks

  • A record at _smtp._tls beginning with v=TLSRPTv1.
  • A rua destination is present.
  • Destinations use mailto: or https:. No other scheme is permitted.
  • Exactly one valid record. RFC 8460 §3 states that if the number of valid records is not exactly one, senders must assume TLS reporting is not implemented. Publishing two therefore results in no reports at all, which is a genuinely counter-intuitive failure.

A minimal record

_smtp._tls.example.com. IN TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

Point it at a mailbox that can absorb a daily report from every sending platform that talks to you. Reports are JSON and are usually compressed.

Related