TLS-RPT record is missing
What it is
TLS-RPT (RFC 8460) is a _smtp._tls TXT record that tells other mail servers where to send reports about failed attempts to deliver mail to you over encryption. Reports usually arrive once a day as compressed JSON.
We only looked at public DNS. We can see whether the record is published and usable (one record, correct version, a mailto: or https: address). We cannot see the reports themselves.
Why it’s a problem
Without reports you do not know that senders are hitting encryption errors on your mail. You need them most when rolling out MTA-STS: they show whether it is safe to switch to enforce.
- The record protects nothing by itself. It gives you visibility, not protection.
- It is a low priority, but it is free and takes five minutes.
How to fix it
1. Create a mailbox for the reports
For example tls-reports@example.com. The reports are machine-generated, so nobody reads them by hand. A service that displays them helps, or at least a filter that files them away.
2. Publish the TXT record
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"Instead of mailto: you can use an https: address that receives the reports by POST. There must be exactly one record. With two, receivers ignore them.
3. Verify
dig +short TXT _smtp._tls.example.comThe first reports usually arrive within two days.