Glossary · Email

TLS-RPT (SMTP TLS Reporting)

TLS-RPT is a standard where sending mail servers report to a domain how often TLS negotiation and MTA-STS checks succeeded or failed when delivering to it.

Updated October 6, 2026

TLS-RPT (SMTP TLS Reporting) is a DNS-published setting that tells other mail servers where to send daily JSON reports about encrypted delivery to your domain, including certificate errors, expired certificates and policy mismatches.

Why it matters

Encrypted mail transport can fail silently: the sender may fall back to plain text or defer the message, and you would not know. With MTA-STS in enforce mode, failures mean rejected or delayed mail, so reports are the safety net that shows what senders actually experience. They are also useful alone, to find a certificate that expired on a secondary mail server.

Example

Record:

_smtp._tls.example.com. IN TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

A report is a compressed JSON file containing the policy that applied, counts such as total-successful-session-count and total-failure-session-count, and failure types like certificate-expired or starttls-not-supported, along with the sending and receiving MX hosts.

Common mistakes

  • Publishing TLS-RPT but never reading the reports.
  • Confusing it with DMARC reports; they cover transport encryption, not sender authentication.
  • Pointing reports at an address on a different domain without the proper setup, so they are dropped.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · EmailCatch-All AddressA catch-all address is a mailbox setting that accepts mail sent to any address at a domain, including ones that do not exist, and delivers it to one inbox.Glossary · EmailEmail AliasAn email alias is an extra address that forwards to an existing mailbox, letting one inbox receive mail for several names without separate accounts.Glossary · EmailEmail Bounce (Hard and Soft)An email bounce is a failed delivery notice from a mail server, with a 4xx or 5xx SMTP code showing whether the failure is temporary or permanent.Guide · EmailBIMI Explained: Show Your Logo in the Inbox (Requirements and Setup)What BIMI is, what it requires (DMARC enforcement, SVG Tiny PS logo, VMC or CMC certificate), how the DNS record looks, and which mailbox providers display it.6 min readGuide · EmailCheck Your Email Domain Setup (MX, SPF, DKIM, DMARC) in 15 MinutesA beginner's walkthrough to check that your business email domain has the right MX, SPF, DKIM and DMARC records, with free tools and plain-language fixes.7 min readGuide · EmailDKIM Setup and Troubleshooting: Selectors, Key Length, RotationHow DKIM selectors and keys work, how to publish and test a record, choose key length, rotate safely, and diagnose the common reasons dkim=fail shows up.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.