TLS-RPT asks sending mail servers to send you a daily report of TLS connection successes and failures to your MX hosts, so MTA-STS or DANE problems surface before mail is lost.
_smtp._tls.gmail.com. 247 IN TXT "v=TLSRPTv1;rua=mailto:[email protected]" ; TLS reporting enabled
_smtp._tls.google.com. 300 IN TXT "v=TLSRPTv1;rua=mailto:[email protected]" ; TLS reporting enabled
_smtp._tls.microsoft.com. 3600 IN TXT "v=TLSRPTv1;rua=https://tlsrpt.azurewebsites.net/report"
; TLS reporting enabled
Senders that support it (Google, Microsoft and others) aggregate their TLS sessions to your domain per day and send a JSON report to each rua destination. The report lists sessions per policy (MTA-STS, DANE or none) and failure types such as certificate-expired, certificate-host-mismatch or starttls-not-supported.
Publish TLS-RPT before switching MTA-STS to enforce. A week of clean reports in testing mode is good evidence that enforcement will not block legitimate mail.
_smtp._tls.example.com. 3600 IN TXT "v=TLSRPTv1; rua=mailto:[email protected]"Wire format: A TXT record at _smtp._tls. Only one TLSRPTv1 record may exist.
| Field | Meaning |
|---|---|
| v | TLSRPTv1, first. |
| rua | Comma-separated mailto: or https: destinations. HTTPS reports are POSTed as gzip JSON. |
rua mailbox that rejects the gzip attachments or large messages._smtp_tls or _tls._smtp: the name is exactly _smtp._tls.