tls.tlsrpt.present
TLS-RPT Configured
What we check
We query DNS for a _smtp._tls.<domain> TXT record and validate its format. This finding is emitted when a valid TLS-RPT record exists.
What this finding means
The domain publishes a TLS-RPT record, enabling sending servers to report TLS negotiation failures. This is a positive configuration signal — the domain operator has set up the feedback channel needed to monitor TLS health and MTA-STS enforcement.
Why it matters
- Visibility into TLS problems. Sending servers that encounter certificate errors, STARTTLS failures, or MTA-STS policy violations will report them to the address specified in the TLS-RPT record.
- MTA-STS companion. TLS-RPT is the recommended companion to MTA-STS — together they form a complete enforce-and-monitor system.
- Proactive monitoring. Reports arrive before users notice delivery problems, enabling early intervention.
Evidence example
$ dig +short TXT _smtp._tls.example.com
"v=TLSRPTv1; rua=mailto:tlsrpt@example.com"
TLS-RPT configured — senders will report TLS failures to this address