What TLS-RPT publishes
A single TXT record at _smtp._tls.<domain> naming a reporting address. Senders that support TLS-RPT pull this record and POST or email daily aggregate reports.
_smtp._tls.yourdomain.com. TXT "v=TLSRPTv1; rua=mailto:tls-rpt@yourdomain.com"What is in a report
A JSON document keyed by sending policy-domain, with per-MTA counts of successful TLS sessions, failed STARTTLS upgrades, certificate hostname mismatches, expired certificates, and the specific failure reasons.
The report covers a 24-hour window. Most receivers send one per day per (policy, sender) pair, so a quiet domain may see only a handful of reports per day; a high-traffic domain sees hundreds.
Why publish TLS-RPT
Visibility into who is failing to deliver to you encrypted, and why. Without reports, an attacker stripping STARTTLS for a single ISP can go unnoticed for weeks.
Pair with MTA-STS: MTA-STS tells senders to require TLS; TLS-RPT tells you when they could not. Together they give you both enforcement and observability.
How SNDR uses TLS-RPT
When SNDR sends to a domain that publishes TLS-RPT, we send back daily aggregate reports — successful counts, failure reasons (cert hostname mismatches, expired certs, missing STARTTLS offers). Receivers see the same kind of data we surface on our own dashboard for outbound mail.