Simple definition
TLS-RPT is a reporting mechanism that lets a domain receive aggregate reports about problems encountered during TLS-secured SMTP delivery.
Technical definition
The domain publishes a DNS TXT policy under _smtp._tls with a reporting destination. Compatible senders can then submit structured reports describing TLS successes and failures observed during delivery attempts.
How it works / role
A sending MTA attempts delivery to the domain, records TLS negotiation results, and aggregates those observations over a reporting period. It then sends a report to the URI declared in the TLS-RPT policy. The data can expose issues such as an MTA-STS configuration error, invalid certificate, or TLS connectivity failure.
What is it used for?
Monitor encrypted SMTP delivery failures and troubleshoot mail TLS policy problems.
Practical example
After MTA-STS is enabled, the administrator receives TLS-RPT reports showing that some senders can no longer validate the MX server certificate.
Common issues
- _smtp._tls record is missing or malformed
- Reporting URI cannot receive reports
- Recurring failures are reported but never investigated
- TLS-RPT is confused with MTA-STS or DMARC
Key takeaway: TLS-RPT is an observation mechanism: it reports SMTP TLS problems but does not itself enforce the encryption policy.