TLS-RPT Record Generator
Generate a valid TLS-RPT DNS record with mailto and HTTPS report destinations per RFC 8460.
Where should TLS failure reports be sent? At least one destination is required.
Simpler to set up. Reports arrive as email attachments. However, if your mail infrastructure is down, you may not receive the very reports that describe the problem.
More reliable for automated processing. Reports are POSTed to your endpoint as JSON. Requires a webhook or API endpoint to receive them.
What is TLS-RPT?
SMTP TLS Reporting (TLS-RPT) is defined in RFC 8460. It enables domain owners to receive structured JSON reports about TLS connectivity problems experienced by sending mail servers. When a remote server encounters a TLS negotiation failure -- such as an expired certificate, hostname mismatch, or missing STARTTLS support -- it sends a report to the endpoints specified in your TLS-RPT DNS record.
Report Format
TLS-RPT reports are JSON documents that include details about the sending organization, the time range covered, the policy applied (MTA-STS or DANE), the result type (e.g., certificate-expired, starttls-not-supported), and counts of successful and failed sessions. Reports are typically sent daily and cover a 24-hour period.
Connection to MTA-STS and DANE
TLS-RPT is a companion protocol to both MTA-STS (RFC 8461) and DANE (RFC 7672). MTA-STS and DANE tell senders to enforce TLS; TLS-RPT provides the feedback loop for when enforcement fails. Deploying TLS-RPT alongside MTA-STS or DANE gives you full visibility into TLS delivery problems. Even without MTA-STS or DANE, TLS-RPT reports on opportunistic STARTTLS failures.
Record Format
| Tag | Required | Description |
|---|---|---|
v | Yes | Version identifier. Must be TLSRPTv1. |
rua | Yes | Comma-separated list of report destination URIs (mailto: and/or https:). |
For a complete guide to TLS-RPT configuration and deployment, see the TLS-RPT learn page.
Read the complete TLS-RPT guide to learn more.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free