dotvitals

TLS-RPT Record Generator

Generate a valid TLS-RPT DNS record so senders report on TLS delivery failures to your mail servers.

The record is published at `_smtp._tls` under the domain that receives the mail, and sending servers read it for that exact name. Anywhere else and the failures carry on happening silently, which is the whole problem this record solves.

About the tls-rpt record generator

A TLS-RPT record is short but has to be exact: a TXT record at _smtp._tls.yourdomain.com containing the version tag and one or more rua addresses to receive daily aggregate reports. This generator produces a correctly formatted record from the reporting address or addresses you provide. It supports both mailto: addresses and HTTPS endpoints as report destinations, since RFC 8460 allows reports to be delivered either by email or by an HTTPS POST to a URL you control, and many domains prefer routing reports to a dedicated processing address or endpoint rather than a general inbox.

You can list more than one rua destination, separated correctly within the record, which is useful when reports should go both to a monitoring address for automated processing and to a mailbox a person actually reads occasionally, without needing to choose only one. The generator also reminds you that TLS-RPT reports on its own do not enforce anything; it only gives you visibility, so pairing it with an MTA-STS or DANE policy is what actually makes the reports describe meaningful enforcement failures rather than just background STARTTLS noise.

Once the record is live, the reports that arrive are only useful if something actually processes them, so routing them to an address or endpoint that is monitored, rather than a mailbox nobody checks, is what turns TLS-RPT into a real signal instead of an ignored inbox. Choosing a destination that is actually watched, rather than the address that happened to be convenient at setup time, is what turns the daily reports into an early-warning system instead of an ignored, slowly filling inbox.

Common questions

What does the record contain?
A version tag, v=TLSRPTv1, and one or more rua values naming where daily aggregate reports should be sent, either as mailto: addresses or HTTPS endpoints.
Can reports go to an HTTPS endpoint instead of email?
Yes, RFC 8460 supports both. Use whichever fits your monitoring setup better; many teams prefer an HTTPS endpoint that feeds directly into automated processing.
Can I list more than one report destination?
Yes, multiple rua values are allowed in one record, comma-separated, which lets you send reports to both an automated system and a human-read mailbox at once.
Do I need MTA-STS to use TLS-RPT?
No, TLS-RPT also reports opportunistic STARTTLS failures on its own, but it becomes most useful once paired with MTA-STS or DANE, since then it reports against an actual enforced policy.