What TLS-RPT means
TLS-RPT — SMTP TLS Reporting, RFC 8460 — is a TXT record at _smtp._tls.example.com reading v=TLSRPTv1; rua=mailto:[email protected]. An https: URI may be given instead of a mailto:. Senders that implement it batch a day's results and deliver a JSON document naming your MX hosts, the policy each session was evaluated against, and counts of successful and failed sessions with a reason recorded for each failure.
The failure reasons are what make it worth publishing: starttls-not-supported, certificate-expired, certificate-host-mismatch, validation-failure, sts-policy-fetch-error. These describe problems visible only from outside — a certificate that expired on one of four MX hosts, a policy naming a host that no longer exists — and nothing in your own monitoring is positioned to see them.
TLS-RPT is independent of MTA-STS but is deployed with it as a matter of routine: publishing a policy in mode: testing and reading the reports for a fortnight is how you find out what enforcement would break before it breaks anything.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.