Check your domain's TLS-RPT configuration. Monitor secure email delivery and detect potential downgrade attacks with Transport Layer Security Reporting.
Skysnag automates the implementation and management of TLS-RPT for your domain, providing valuable insights into your email security posture.
Automated Setup
Generate and deploy TLS-RPT records with zero manual configuration
Report Collection
Collect and aggregate TLS reports from sending mail servers
MTA-STS Integration
Seamlessly integrate with MTA-STS for comprehensive email security
Visual Dashboards
Transform complex TLS reports into easy-to-understand visualizations
Security Alerts
Get notified of potential downgrade attacks or TLS failures
Compliance Monitoring
Track compliance with your secure email delivery policies
TLS-RPT (Transport Layer Security Reporting) is an email security standard that enables domains to receive reports about TLS connectivity problems. It works alongside MTA-STS to provide visibility into secure email delivery and detect potential security issues.
Receive reports when email delivery attempts fail due to TLS issues, helping identify security vulnerabilities.
Identify potential man-in-the-middle attacks where secure connections are downgraded to unencrypted ones.
Gain visibility into how many emails are being delivered securely versus insecurely.
Works alongside MTA-STS to provide reporting on policy failures and enforcement issues for complete protection.
A TLS-RPT record consists of these key components that define how reporting should be handled:
Format of the TLS reports (typically 'tlsrpt')
How long the policy should be cached (in seconds)
See the impact of implementing TLS-RPT with Skysnag
100%
visibility into TLS failures
95%
reduction in undetected attacks
24/7
monitoring and alerts
99.9%
secure email delivery rate
Meet with one of our experts to review your report. We'll walk you through the issues, explain the security gaps, and show you exactly how Skysnag resolves them - automatically.
Discuss my resultsSkysnag gives you everything you need to enforce DMARC, automate SPF and DKIM, deploy MTA-STS and TLS-RPT, and activate BIMI - so your emails are secure, compliant, and trusted.
Monitor
Identify email compromise attempts and troubleshoot email delivery issues
Comply
Comply with Microsoft, Google and Yahoo requirements and visualize sending data in real-time
Protect
Automate DMARC enforcement for unparalleled email security
Certify
Certify your brand with the highest identity standard globally
A TLS-RPT record is a DNS TXT record, published at _smtp._tls.yourdomain.com, that asks other mail servers to send you daily reports when they fail to deliver email to you over an encrypted (TLS) connection. It is how you get visibility into encryption problems that would otherwise be silent, and it pairs with MTA-STS.
TLS-RPT (SMTP TLS Reporting), defined in RFC 8460, lets a domain request diagnostic reports about the success or failure of TLS encryption on inbound email. Sending servers that support it will deliver daily aggregate reports to the address in your record.
Email encryption (STARTTLS) usually fails silently — if a sending server can’t negotiate TLS, it may fall back to plaintext or drop the message, and you would never know. TLS-RPT surfaces these events so you can fix misconfigurations and detect downgrade attacks.
TLS-RPT is the reporting half of a pair: MTA-STS enforces encrypted delivery, and TLS-RPT tells you when and why it fails. Deploy both together.
A TLS-RPT record is a TXT record at the _smtp._tls subdomain.
Query the _smtp._tls subdomain:
$ dig TXT _smtp._tls.example.com +shortThe record must contain v=TLSRPTv1 and a rua= destination — a mailto: address or an https:// endpoint that can receive reports.
_smtp._tls.example.comv=TLSRPTv1; rua=mailto:tls-reports@example.comA TLS-RPT record directing daily TLS delivery reports to a monitored mailbox.
A TLS-RPT record has two tags.
| Tag | Type | Meaning |
|---|---|---|
v |
Required | Version. Must be TLSRPTv1. |
rua |
Required | Where to send reports: a mailto: address or an https:// endpoint. |
Common TLS-RPT results.
| Result | What it means & what to do |
|---|---|
| No TLS-RPT record | Publish one with a valid rua so you gain visibility into TLS delivery failures. |
| Record present, no reports arriving | Reports are daily and only come from senders that support TLS-RPT; confirm the rua mailbox can receive them. |
| No MTA-STS alongside it | TLS-RPT reports failures but does not enforce TLS. Add MTA-STS for enforcement. |
A TLS-RPT record is a DNS TXT record at _smtp._tls.yourdomain.com that asks sending mail servers to report failed or downgraded TLS connections when delivering email to you.
Run dig TXT _smtp._tls.yourdomain.com +short and confirm it starts with v=TLSRPTv1 and contains a rua= destination, or use the checker above.
MTA-STS enforces that inbound email is delivered over TLS; TLS-RPT reports on whether that encryption succeeded or failed. MTA-STS is the rule, TLS-RPT is the feedback. Use them together.
To the address in your rua= tag — either a mailbox (mailto:) or an HTTPS endpoint. Reports are aggregate, sent daily by participating senders.
