Skip to content

Check out zerohook.org

ZeroHook | SecurityTools

What is / Full version

TLS-RPT

The TXT record at _smtp._tls is the reporting policy. Senders that see a TLS failure on the way in send a report to rua.

Short answer

The name

The policy lives under _smtp._tls. For example.com the name is _smtp._tls.example.com. RFC 8460's MAILTO example is v=TLSRPTv1;rua=mailto:[email protected]. Its HTTPS example is rua=https://reporting.example.com/v1/tlsrpt.

If the resolver returns more than one TXT record, records that do not begin with v=TLSRPTv1; are discarded.

What it reports

RFC 8460 exists because STARTTLS, DANE TLSA, and MTA-STS can fail from misconfiguration or from an active attack. The report is how a sending system tells the recipient domain about those failures.