TLS-RPT setup: the single DNS record and when it's worth it

TLS-RPT is a single, provider-agnostic TXT record that emails you reports about TLS failures. When it's worth it, what it reports, and how to publish it.

Last updated: July 2026

In short: TLS-RPT (SMTP TLS Reporting, RFC 8460) makes other mail servers send you reports when encrypted delivery to your domain fails. It's a single TXT record under _smtp._tls, whose only variable part is your own reporting address — so setup is identical at every provider. And it's only useful once you run MTA-STS or DANE: TLS-RPT reports on their failures.

Unlike SPF or DKIM, TLS-RPT has no provider-specific value (no include:, no selector). You publish the same record everywhere, whether your DNS is at IONOS, Cloudflare, or GoDaddy. Where exactly you add a TXT record is covered by your provider's SPF and DKIM guides.

What TLS-RPT reports

MTA-STS and DANE force encrypted connections to your domain — but if something goes wrong, you won't know without TLS-RPT. It closes that gap by letting senders that are

compatible with MTA-STS or DANE to share success and failure

statistics with you. Reported issues include

failures in routing, DNS resolution, and STARTTLS negotiation

— exactly the problems that break your encrypted delivery.

The prerequisite: MTA-STS or DANE

This is the key point: without MTA-STS or DANE, TLS-RPT has nothing to report. TLS-RPT isn't a standalone protection — it's the reporting layer for those two mechanisms. Set up MTA-STS or DANE first; TLS-RPT comes afterward as a small, risk-free add-on.

The record

TLS-RPT is a TXT record under the name "_smtp._tls" of your domain — i.e. _smtp._tls.your-domain.com. The version value is mandatory:

This document defines version 1 of TLSRPT, for which this value MUST be equal to "TLSRPTv1".

The rua= tag sets where reports go:

A URI specifying the endpoint to which aggregate information about policy validation results should be sent

That can be an email address (mailto:) or an HTTPS endpoint (rua=https://reporting.example.com/v1/tlsrpt). For most people, mailto: is enough:

v=TLSRPTv1;rua=mailto:reports@example.com

Replace reports@example.com with your own reporting address. Make sure the record begins with v=TLSRPTv1; — records that do not begin with "v=TLSRPTv1;" are discarded.

Is TLS-RPT worth it for you?

Yes, if you already run MTA-STS or DANE and want to know whether (and where) encrypted delivery to you is failing — the effort is a single DNS record.
No (not yet), if you run neither MTA-STS nor DANE. There's no TLS policy to report on, so the record does nothing.

If you point the daily XML/JSON reports at a real address, plan to actually process them (or use a monitoring tool) — otherwise you're collecting reports nobody reads.

Verifying your setup