TLS-RPT (email TLS reports)
TLS-RPT (TLS Reporting) is a mechanism that allows email servers to send you daily reports on TLS problems encountered when routing emails t…
Analyse my site for freeUnderstanding "TLS-RPT (email TLS reports)"
TLS-RPT (SMTP TLS Reporting) is the reporting mechanism that naturally pairs with MTA-STS: it tells sending servers an email address to send daily aggregated reports about TLS connection failures encountered while trying to deliver email to your domain.
Without TLS-RPT, an MTA-STS policy can work silently in the background with no visibility for you into blocked delivery attempts — useful for detecting both actual attacks and configuration errors on partner servers.
How TheSiteFuse checks "TLS-RPT (email TLS reports)"
TheSiteFuse queries the TXT record _smtp._tls.<domain> and looks for a value containing v=TLSRPTv1. As with MTA-STS, the absence of this record is classified as "info" — it's an optional visibility enhancement, not directly tied to the active security of email delivery itself (which depends on MTA-STS).
Why "TLS-RPT (email TLS reports)" matters
- Invisible attacks without reporting — without TLS-RPT, an interception or TLS-downgrade attempt targeting your inbound email generates no alert on your side, even if MTA-STS technically blocks it.
- Harder configuration troubleshooting — TLS-RPT reports also help spot legitimate configuration issues at email partners (expired certificates, a sender's misconfigured TLS), which would otherwise go unnoticed until a user reports missing emails.
- Relatively low priority — unlike the other checks in this category, the absence of TLS-RPT creates no direct vulnerability; it's a monitoring tool, not a protection.
Fix "TLS-RPT (email TLS reports)" step by step
Publish the DNS record
Name: _smtp._tls.yourdomain.com Type: TXT Value: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com
Receive and process reports
TLS-RPT reports are sent in compressed JSON format, daily, by major compatible mail providers (notably Google, Microsoft, Yahoo). They're hard to read manually at volume; consider a third-party DMARC/TLS-RPT report processing service if you receive significant email traffic, or a dedicated address monitored periodically for a more modest volume.
Prerequisite: configure MTA-STS before TLS-RPT — the latter only provides real value combined with an active enforcement policy.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — TLS-RPT (email TLS reports)Does your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.