← All checks

TLS-RPT record missing: how to get SMTP TLS reports

TLS reporting (TLS-RPT) low Email transport · 2 of 100 points

What it inspects

The TXT record at _smtp._tls.<domain>. Verdicts: PASS for one record starting v=TLSRPTv1 with a rua= list of mailto: or https: URIs. WARN when none is published. FAIL when the record is malformed or there is more than one. Not applicable if the domain does not receive mail.

Why it matters

TLS-RPT is the feedback channel for MTA-STS and STARTTLS: senders tell you when they could not deliver securely, so you notice an expired certificate before your mail bounces.

How to verify by hand

# bash
dig +short TXT _smtp._tls.example.com

# PowerShell
Resolve-DnsName -Name _smtp._tls.example.com -Type TXT | Select-Object -ExpandProperty Strings

How to fix

Publish a TXT record with a mailbox (or reporting service) that will receive the daily JSON reports.

  1. Publish the record:

    _smtp._tls.example.com.  IN  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

References

Scan your domain free