TLS-RPT HTTPS report endpoint is unreachable
What this check looks for
Your record asks for reports to be posted to a web address that does not accept them. The reports are generated and then thrown away.
Why it matters
Reporting looks configured and produces nothing, so a delivery problem can run for weeks without a signal.
When the check passes, your report says: “The TLS-RPT endpoint accepts the reports sent to it”.
What it costs your score
When this check fails it removes 4 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.tls-rpt family ceiling of 10 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- high
- Status when triggered
- fail
- Deduction
- 4 points
- Family cap
- email-transport.tls-rpt · 10
- Category
- Email transport
- Module
- Email tls rpt
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Fix the endpoint, or switch to a mailto: destination.
An endpoint that rejects the POST discards every report that is generated for you.
Confirm the endpoint accepts an unauthenticated POST with Content-Type application/tlsrpt+gzip.
Check for a WAF or bot rule blocking the reporting senders.
If in doubt, use a
mailto:destination — it has no such failure modes.
How to confirm it worked
curl -sI -X POST ‹report uri› -H 'Content-Type: application/tlsrpt+gzip' — expect a 2xx
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The rua= target ‹report uri› did not accept a report POST: ‹fetch error›. RFC 8460 §3 requires an HTTPS endpoint to accept POST with Content-Type: application/tlsrpt+gzip; endpoints behind authentication or a WAF rule that blocks unknown clients silently drop every report.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.