What is TLS-RPT?

TLS-RPT (SMTP TLS Reporting, RFC 8460) is the reporting companion to MTA-STS and DANE. On its own it doesn't enforce anything - it just tells sending mail servers where to report TLS negotiation failures for messages sent to this domain, as a daily aggregate report.

Why it matters more than it looks

MTA-STS and DANE both work by making sending servers refuse a connection under certain conditions. Without TLS-RPT, a refusal is completely silent from the receiving domain's point of view - mail simply doesn't arrive, with no error, no bounce, and no way to tell whether that's because of a genuine attack, a misconfigured MX host, or a policy that's stricter than intended. TLS-RPT is what turns "mail stopped arriving from somewhere" into an actual, readable report.

What a record looks like

A single DNS TXT record at _smtp._tls.yourdomain.com, in the form v=TLSRPTv1; rua=mailto:reports@yourdomain.com. The rua= tag accepts one or more addresses, comma-separated, each either a mailto: address or an https: endpoint that accepts the report payload.