TLS RPT Record Builder
Compose SMTP TLS Reporting (TLS-RPT) TXT records with ruas endpoints for mail security monitoring.
Publish SMTP TLS-RPT DNS records
TLS-RPT (RFC 8460) lets receiving mail servers report TLS
negotiation failures to domain owners. Publish a TXT record at
_smtp._tls.example.com with v=TLSRPT1 and one or more
rua= reporting URIs (typically mailto: or HTTPS
endpoints). This builder formats the record and shows the correct DNS host name.
Deployment checklist
- Create a mailbox or HTTPS endpoint that accepts aggregate TLS failure reports.
- Publish the generated TXT at
_smtp._tlson your mail domain. - Monitor reports alongside DMARC aggregate data for downgrade or certificate issues.
Also see DMARC Record Builder and SPF Generator for related email authentication DNS records.
Frequently Asked Questions
What is the difference between TLS-RPT and MTA-STS?
MTA-STS publishes an HTTPS policy that instructs senders to use TLS with valid certificates. TLS-RPT provides feedback when TLS delivery fails. They complement each other but use different DNS names and formats.
Can I list multiple rua endpoints?
Yes. Separate URIs with commas in the builder; they are joined in the
single rua= tag per RFC 8460.
Is the optional max_age tag included?
You may set max_age in seconds when your reporting provider
requires it. Leave the field blank to omit the tag.