What TLS-RPT Does
TLS-RPT gives domain owners visibility into SMTP TLS issues that can affect secure email delivery. It helps email administrators, DNS teams, and security leaders identify transport failures and investigate delivery problems.
That visibility matters because transport security issues aren’t always obvious. A certificate problem, policy mismatch, or DNS error can disrupt secure delivery without making the root cause clear. TLS-RPT helps close that gap by giving teams reports on TLS-related delivery failures.
In practice, TLS-RPT helps teams:
- Detect issues affecting secure email delivery
- Improve visibility into transport failures
- Support troubleshooting when email security controls aren’t working correctly
- Reduce the risk of unresolved TLS problems across domains
TLS-RPT is commonly used alongside MTA-STS. MTA-STS helps define how receiving servers should handle secure SMTP delivery, while TLS-RPT provides the reporting that helps your team understand TLS-related issues.
TLS-RPT Setup With Sendmarc
Step 1: Get the Values From Sendmarc
Start by getting the Sendmarc-provided values for your domain.
Sendmarc provides the unique value your team needs to create the TLS-RPT record.
Step 2: Create the TLS-RPT CNAME Record in Your DNS
Publish the TLS-RPT record in your DNS using the Sendmarc-provided value.
Use the following pattern:
| Host | Type | Value |
|---|---|---|
| _smtp._tls | CNAME | example.com._smtp._tls.sdmarc.net. |
The hostname must be published exactly as _smtp._tls. The record type must be CNAME. The value must match the delegated value provided by Sendmarc.
This is the key part of the TLS-RPT setup. Your DNS publishes the CNAME, and Sendmarc hosts the underlying TLS-RPT value.
Step 3: Specify the Policy
The TLS-RPT policy should include the v=TLSRPTv1 tag, followed by the rua reporting URI tag.
For example:
v=TLSRPTv1; rua=mailto:[email protected]
Step 4: Wait for DNS Propagation
After publishing the CNAME record, allow time for DNS propagation.
Propagation times vary by server and TTL settings, but your team should wait 24-48 hours before treating the update as complete.
Step 5: Verify the Record Was Added Correctly
Once the record has propagated, use Sendmarc’s TLS Record Checker to verify that your TLS-RPT record is live and correctly configured.
Strengthen Your Email Security Beyond TLS-RPT
TLS-RPT should be part of a broader email security strategy.
Teams setting up TLS-RPT often need support with related controls, especially when they want stronger transport security, better sender authentication, and more control over DNS-based records.
MTA-STS Management
Sendmarc helps publish and maintain MTA-STS policies to support stronger transport security and reduce manual record management.
DMARC Management
Sendmarc helps improve visibility into domain spoofing, support policy rollout, and move toward stronger DMARC enforcement over time.
SPF and DKIM Support
Sendmarc supports SPF and DKIM management to help strengthen sender authentication and reduce the risk of misconfiguration.
Centralized DNS Delegation
For supported records, centralized DNS delegation reduces manual changes and helps lower the risk of typos and publishing mistakes.