What it is

A TXT record at _smtp._tls.yourdomain of the form v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain. Sending servers that support it — Google, Microsoft and most large providers — send a daily report to that address describing every attempt to deliver to you over TLS and whether it succeeded. The format is defined in RFC 8460.

What the reports contain

Each report is a gzip-compressed JSON file covering one day from one reporting organisation. It lists the policy it applied (MTA-STS, DANE, or none), the number of successful sessions, and for every failure the type — certificate mismatch, STARTTLS not offered, policy fetch failure — with the MX host involved. On a healthy Google or Microsoft domain every report says the same thing: all sessions succeeded, zero failures.

The moment an MX host is missing from your MTA-STS policy, or a certificate expires, the failures appear here first. Nobody else will tell you.

Setting it up

Publish the record before you publish an MTA-STS policy, so you have visibility from the first day of testing mode. Use a dedicated mailbox or a reporting service that also handles DMARC aggregates; the raw JSON is fine to read by hand for one domain and unmanageable for a fleet. Then confirm with the MTA-STS checker that the record is visible and has a valid rua.

Check yours

These run free in your browser. Nothing you type reaches a server.

Common questions