What TLS-RPT does
TLS-RPT (RFC 8460) asks sending servers to report TLS negotiation failures to you, so you learn when an MTA-STS or DANE policy is blocking mail. The record lives at _smtp._tls.domain and needs a mailto: or https: rua destination.
TLS-RPT checker: questions
What is a TLS-RPT record?+
A TXT record at _smtp._tls.example.com that asks sending servers to report problems establishing TLS when they deliver to your MX hosts (RFC 8460). It looks like v=TLSRPTv1; rua=mailto:[email protected], and the rua= destination must be a mailto: or https: URI. It changes nothing about delivery; it only requests reports.
What is in a TLS-RPT report?+
A JSON summary, usually gzip-compressed, of one organisation's TLS connections to your MX hosts over a day. For each policy it applied (MTA-STS, DANE or none found) it gives the number of successful and failed sessions and the failure types, such as an expired certificate, a certificate that does not match the host, or STARTTLS not offered. It contains no message content.
Do I need MTA-STS to use TLS-RPT?+
No. TLS-RPT works on its own, and reports for a domain without MTA-STS or DANE use the policy type no-policy-found, showing whether senders could establish TLS at all. It is most useful alongside MTA-STS, because in testing mode the reports show which senders would fail before you switch to enforce.
Can TLS-RPT reports be sent to an HTTPS endpoint?+
Yes. RFC 8460 accepts https: URIs in rua=, to which senders POST the compressed JSON report, as well as mailto: addresses, and several destinations can be listed separated by commas. The checker flags a rua= that starts with neither scheme, such as [email protected] without mailto:.
How often are TLS-RPT reports sent?+
Once a day per sending organisation, normally covering a full UTC day, and only from senders that support TLS-RPT and delivered mail to you that day. Large mailbox providers such as Google send them; a domain that receives little mail may get few reports or none.