No TLS-RPT record published
What this check looks for
Nobody tells you when encrypted delivery to your mail servers fails. Senders that could not connect securely simply do not, and you never find out.
Why it matters
TLS-RPT is how you learn that an expiring certificate or a broken MTA-STS policy is quietly costing you mail. It is the safety net that makes moving MTA-STS to enforce a reasonable thing to do.
When the check passes, your report says: “TLS-RPT asks receivers to report failed encrypted delivery”.
What it costs your score
When this check fails it removes 4 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.tls-rpt family ceiling of 10 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- email-transport.tls-rpt · 10
- Category
- Email transport
- Module
- Email tls rpt
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Publish a TLS-RPT record pointing at a mailbox you will read.
Without it, TLS delivery failures to your domain are invisible to you.
Choose a mailbox or a reporting service to receive the daily JSON reports.
Publish
v=TLSRPTv1; rua=mailto:‹report address›at_smtp._tls.‹domain›.Do this before moving MTA-STS to enforce, so you can see failures first.
How to confirm it worked
dig +short TXT _smtp._tls.‹domain› — expect a v=TLSRPTv1 record
_smtp._tls.{{domain}}. 3600 IN TXT "v=TLSRPTv1; rua=mailto:{{reportAddress}}"A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
_smtp._tls.‹domain›. 3600 IN TXT "v=TLSRPTv1; rua=mailto:‹report address›"DNS → Records → Add record → Type: TXT, Name: _smtp._tls, Content: v=TLSRPTv1; rua=mailto:‹report address›Technical detail
No TXT record was found at _smtp._tls.‹domain›. RFC 8460 §3 defines the record as v=TLSRPTv1; rua=mailto:... or an HTTPS endpoint; sending domains then post a daily JSON summary of successful and failed TLS sessions to your domain. It costs one DNS record and creates no delivery risk of its own.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.