📈

TLS Reporting (TLS-RPT)

SMTP TLS Reporting mechanism to receive daily logs of email encryption failures.

RFC: RFC 8460
DNS RECORD: _smtp._tls.domain.com
COMPANION: MTA-STS

What is TLS Reporting (TLS-RPT)?

TLS-RPT works alongside MTA-STS. While MTA-STS enforces encryption, TLS-RPT gives domain administrators visibility by asking servers to send JSON-formatted daily reports about successful and failed encrypted connections.

How it Works

A TXT record is published indicating where reports should be emailed (e.g., `v=TLSRPTv1; rua=mailto:reports@domain.com`). When a major provider like Google fails to negotiate a secure connection with your mail server, they log the technical reason and send it to you.

Key Use Cases

Detecting expired or misconfigured SSL certificates on your company's mail exchange servers.

Identifying active network tampering or firewalls intercepting traffic.

Validating that a new MTA-STS policy won't accidentally drop legitimate mail.

Advanced Details

Unlike DMARC reports which are XML, TLS-RPT aggregates are delivered in JSON format, usually GZIP compressed, detailing the specific stage of the TLS handshake that collapsed.

Cybersecurity Pros & Cons

Security Advantages
  • Provides daily visibility into TLS handshake failures — enabling proactive detection of certificate expiry before outages.
  • Detects active STARTTLS downgrade attacks where a network device is stripping encryption from SMTP connections.
  • Pairs with MTA-STS to create a complete enforcement + visibility framework for email transport security.
  • JSON report format is machine-readable — easy to ingest into SIEM platforms for automated alerting.
Security Limitations
  • TLS-RPT reports are 24-hour delayed — an active MITM attack may complete before the failure data reaches analysts.
  • The reporting email address in the TLS-RPT record is publicly visible — a potential target for report flooding attacks.
  • TLS-RPT alone provides no protection — it only reports failures; MTA-STS or DANE is needed for enforcement.
  • Low adoption among sending mail servers means TLS failures from smaller providers may never generate reports.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs