---
title: "What is TLS-RPT? How to Set Up SMTP TLS Reporting and Read the Reports | DMARC Report"
description: "Learn what TLS-RPT is, how to configure SMTP TLS reporting, publish DNS records, interpret reports, and troubleshoot email encryption failures."
image: "https://dmarcreport.com/og/blog/what-is-tls-rpt-setup-smtp-tls-reporting-read-reports.png"
canonical: "https://dmarcreport.com/blog/what-is-tls-rpt-setup-smtp-tls-reporting-read-reports/"
---

Quick Answer

TLS-RPT (Transport Layer Security Reporting) helps domain owners monitor SMTP encryption failures, certificate errors, and email delivery issues. By publishing a TLS-RPT DNS record, administrators can receive reports, troubleshoot TLS problems, and improve email security alongside MTA-STS.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=What%20is%20TLS-RPT%3F%20How%20to%20Set%20Up%20SMTP%20TLS%20Reporting%20and%20Read%20the%20Reports&url=undefined%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F&title=What%20is%20TLS-RPT%3F%20How%20to%20Set%20Up%20SMTP%20TLS%20Reporting%20and%20Read%20the%20Reports "Share on Reddit") [ ](mailto:?subject=What%20is%20TLS-RPT%3F%20How%20to%20Set%20Up%20SMTP%20TLS%20Reporting%20and%20Read%20the%20Reports&body=Check out this article: undefined%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F "Share via Email") 

![TLS-RPT SMTP Reporting Setup Guide](https://media.mailhop.org/dmarcreport/dmarc-lookup-9820-1792670958107.jpg) 

## What TLS-RPT Is and Why SMTP TLS Reporting Matters

[TLS-RPT](https://dmarcreport.com/tls-rpt/), defined in RFC 8460, allows domain owners to receive reports about TLS encryption problems affecting inbound email. Also called SMTP TLS reporting or Transport Layer Security reporting, it helps administrators monitor encrypted mail traffic.

When a sending Mail Transfer Agent (MTA) uses STARTTLS to encrypt an **SMTP connection**, a failed TLS handshake can generate an aggregate report. _These reports help identify certificate errors, downgrade attempts, server misconfigurations, and email delivery failures._

### Why SMTP TLS Reporting Matters

SMTP uses opportunistic encryption, meaning sending servers may fall back to unencrypted delivery if TLS is unavailable. This can expose email to [man-in-the-middle attacks](https://www.darkreading.com/endpoint-security/man-in-the-middle-attacks-a-growing-but-preventable-mobile-threat), TLS downgrade attempts, and weak encryption configurations.

_TLS-RPT improves visibility by monitoring encryption failures and helping teams identify certificate issues, MX changes, and provider migration problems._ It supports email security, compliance, and reliable delivery, especially for business-critical messages such as invoices, **legal notices**, [account recovery emails](https://www.safeguardsconsulting.com/knowledge/2025/12/10/detecting-fake-account-recovery-emails), and customer support communications.

## How TLS-RPT Works with MTA-STS and Email Security

![Dmarc Report 8317](https://media.mailhop.org/dmarcreport/dmarc-report-8317-1792671091153.jpg)

### The Relationship Between TLS-RPT and MTA-STS

TLS-RPT works alongside [MTA-STS (RFC 8461)](https://www.captaindns.com/en/blog/mta-sts-complete-guide), which lets domains specify approved MX hosts and require TLS encryption. Policies can use testing mode to identify issues without blocking messages or enforce mode to prevent delivery when TLS requirements are not met. **TLS-RPT reports** help administrators assess whether enforcement is safe.

_A recommended rollout is to publish the TLS-RPT DNS record first, enable MTA-STS in testing mode, and switch to enforce mode after reviewing reports._ Before enforcement, verify that all listed MX hosts support STARTTLS, use trusted certificates, and match the published policy.

### TLS-RPT, DANE, and Broader Email Security

MTA-STS and DANE both improve SMTP security but use different methods. MTA-STS relies on HTTPS and trusted certificate authorities, while DANE uses [DNSSEC](https://www.digicert.com/blog/understanding-dnssec-best-practices-and-implementation-challenges) to verify certificate associations. TLS-RPT helps administrators identify encryption and policy failures involving these mechanisms.

TLS-RPT also complements email authentication protocols such as [SPF,](https://dmarcreport.com/dmarc-fundamentals/what-is-spf/) [DKIM](https://dmarcreport.com/what-is-dkim), and DMARC. These protocols help **prevent spoofing** and verify sender identity, while MTA-STS, DANE, and TLS-RPT focus on securing and monitoring email transport. Together, they provide better visibility into domain authentication and encryption.

## How to Create and Publish a TLS-RPT DNS Record

### TLS-RPT DNS Record Format

To enable smtp tls reporting, publish a TLS-RPT DNS record as a [DNS TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/) at:

```
smtp.tls.yourdomain.com
```

A basic DNS TXT record looks like this:

```
v=TLSRPTv1; rua=mailto:tlsrpt@example.com
```

Here, `v=TLSRPTv1` identifies the record as a TLS-RPT record, and `rua` defines the reporting URI. The reporting URI is where aggregate data will be sent. You can use a reporting email address such as `smtp-tls-reporting@organization.com`, `tlsrpt@example.com`, or a **managed endpoint from platforms**. In plain-text configuration notes, that same reporting address may appear as `smtp-tls-reporting@organization.com`, which is a practical shared mailbox for Organization Inc.

![Dmarc Generator 2079](https://media.mailhop.org/dmarcreport/dmarc-generator-2079-1792671050039.jpg)

Some organizations also use [HTTPS report](https://www.searchenginejournal.com/google-adds-new-https-report-to-search-console/464514/) collection endpoints, for example:

```
v=TLSRPTv1; rua=mailto:smtp-tls-reporting@organization.com,https://tlsreport.example.com/reports
```

_Before publishing, check whether your mail provider, Domain Registrar, and DNS host support long TXT values correctly._

Choose a shared mailbox, [ticketing system](https://revenuebase.ai/companies/ticketing-system-software-companies/united-states), or security dashboard to receive and review TLS reports. This prevents missed reports when employees change roles and helps track recurring TLS failures through your existing **security workflow**.

### Example TLS-RPT DNS Record for an Organization

For `Organization Inc.`, a practical TLS-RPT DNS record might be:

```
smtp.tls.organization.com. IN TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reporting@organization.com"
```

If the domain receives mail through `mail.example.com` and uses MTA-STS in enforce mode, TLS-RPT reports will show whether senders such as Google, Microsoft, or Mailgun successfully established TLS encryption.

Organization Inc. could also separate reporting by **environment or brand domain**. For example, a primary [corporate domain](https://www.zacco.com/en/service/corporate-domain-management/) may send reports to a central security mailbox, while a customer-facing transactional domain may use a managed reporting endpoint. _This separation helps teams identify whether a problem affects all mail infrastructure or only a specific platform, MX host, or business unit._

For a more explicit production example, Organization Inc. could publish a TLS-RPT DNS record that sends reports to `smtp-tls-reporting@organization.com` and monitors MX hosts such as `smtp.example.org` or `smtp.tls.yourdomain.com`. This makes it easier to connect the reporting destination, the expected SMTP connection path, and the certificate names reviewed during troubleshooting.

#### Using a TLS-RPT Record Generator

![Dmarc Record 4709](https://media.mailhop.org/dmarcreport/dmarc-record-4709-1792671141628.jpg)

A TLS-RPT record generator can help reduce [syntax errors](https://university.webflow.com/glossary/syntax-error). Tools from email security providers, can create the correct DNS TXT record, validate the **reporting URI**, and confirm whether the TLS-RPT DNS record is discoverable. Still, administrators should understand the record structure, because a small typo in `v=TLSRPTv1` or `rua=` can stop report delivery.

After generating the record, validate it from more than one DNS resolver. [DNS caching](https://www.cloudns.net/blog/dns-cache-explained/) and propagation delays can make troubleshooting confusing, especially after a recent change at the Domain Registrar. _It is also helpful to document the record owner, the purpose of the reporting address, and the expected review cadence so future administrators understand why the record exists._

## Operationalizing TLS-RPT Monitoring Over Time

After setup, TLS-RPT should be included in regular email monitoring. Review reports weekly for small domains or daily for high-volume environments. Repeated `certificate-not-trusted`, `validation-failure`, or `starttls-not-supported` errors should trigger investigation, especially when MTA-STS is in enforcement mode.

Organizations should also use TLS-RPT to monitor infrastructure changes. **Capture baseline reports** before changing [MX records](https://www.cloudns.net/wiki/article/12/), switching providers, or adding security gateways, then compare new reports to confirm that [TLS encryption](https://www.encryptionconsulting.com/guide-to-tls-encryption/) remains stable.

Finally, retain historical reports or summarized metrics where practical. _Historical data can show whether certificate renewals are improving, whether a provider migration reduced failures, or whether a recurring problem appears at the same time each month._ Combined with [DMARC](https://dmarcreport.com/) reporting, [mail logs](https://billionverify.com/glossary/email-logs), and provider dashboards, TLS-RPT gives administrators a clearer view of how securely and reliably email is moving across the **public internet**.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) 

 AutoSPF 

Automatic SPF Flattening

Streamline your SPF record management, enable DMARC compliance, and improve your email deliverability by fixing the SPF 10-lookup limitation.

[ Fix My SPF Record! → ](https://autospf.com/pricing/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=fix-my-spf) [ See How It Works ](https://autospf.com/how-it-works/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=how-it-works) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F) [ ](https://twitter.com/intent/tweet?text=What%20is%20TLS-RPT%3F%20How%20to%20Set%20Up%20SMTP%20TLS%20Reporting%20and%20Read%20the%20Reports&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fwhat-is-tls-rpt-setup-smtp-tls-reporting-read-reports%2F) Copy 

Related Articles

- [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg)  10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/)
- [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg)  Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)
- [ ![Cybersecurity Threats Weekly Roundup](https://media.mailhop.org/dmarcreport/dmarc-lookup-2281-1792584391252.jpg)  Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads Intermediate ](/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/)
- [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg)  AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)

## Related Articles

[  Intermediate 4m  10 Reasons Why DKIM Fails  Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[  Intermediate  Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows  Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[  Intermediate  Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads  Oct 21, 2026 ](/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/)[  Intermediate  AppRiver SPF Record: How To Set It Up (Owned By Zix)  Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"What is TLS-RPT? How to Set Up SMTP TLS Reporting and Read the Reports","description":"Learn what TLS-RPT is, how to configure SMTP TLS reporting, publish DNS records, interpret reports, and troubleshoot email encryption failures.","url":"https://dmarcreport.com/blog/what-is-tls-rpt-setup-smtp-tls-reporting-read-reports/","datePublished":"2026-10-22T00:00:00.000Z","dateModified":"2026-10-22T00:00:00.000Z","dateCreated":"2026-10-22T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 5,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/what-is-tls-rpt-setup-smtp-tls-reporting-read-reports/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-lookup-9820-1792670958107.jpg","caption":"TLS-RPT SMTP Reporting Setup Guide"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"What is TLS-RPT? How to Set Up SMTP TLS Reporting and Read the Reports","item":"https://dmarcreport.com/blog/what-is-tls-rpt-setup-smtp-tls-reporting-read-reports/"}]}
```