tls.tlsrpt.missing
TLS-RPT Not Configured
What we check
We query DNS for a _smtp._tls.<domain> TXT record. TLS-RPT (SMTP TLS Reporting) tells sending servers where to send reports about TLS negotiation failures when delivering mail to your domain.
What this finding means
No TLS-RPT record was found. Without it, sending servers that encounter TLS problems delivering to your domain have no way to report them to you. TLS failures happen silently.
Why it matters
- Blind to failures. Without TLS-RPT, you have no visibility into TLS negotiation failures that senders experience. Certificate problems, STARTTLS stripping, or MTA-STS policy violations go unreported.
- Complements MTA-STS. TLS-RPT is the feedback channel for MTA-STS — deploying MTA-STS without TLS-RPT means you cannot monitor whether enforcement is working correctly or causing delivery problems.
- Low effort, high value. A single DNS TXT record is all that is needed. No infrastructure changes required — reports are delivered to the specified email address or HTTPS endpoint.
How to fix
Publish a TLS-RPT DNS record:
_smtp._tls.example.com. IN TXT "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"Set up a mailbox or HTTPS endpoint to receive the reports. Reports are JSON-formatted and typically arrive daily from major senders.
Verify:
dig +short TXT _smtp._tls.example.com # Expected: "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"
How it's graded
Missing TLS-RPT carries a 5-point deduction in the Bonus category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT _smtp._tls.example.com
(empty)
No TLS-RPT record — TLS failures are not reported to the domain owner