TLS-RPT is the evidence channel for transport security. Sending MTAs report daily on what happened when they tried to deliver to you over TLS — successes and failures both — which makes it the only way to know that MTA-STS is working rather than merely published.
The record
"v=TLSRPTv1;rua=mailto:sts-reports@google.com" "v=TLSRPTv1;rua=https://tlsrpt.azurewebsites.net/report"
Two destination forms are defined. mailto: delivers the report as a message; https: has the sender POST it to an endpoint. The HTTPS form is rare and Outlook is a live example of it.
What a report contains
| Field | Says |
|---|---|
| Policy type | sts, tlsa or no-policy-found — which mechanism was in play |
| Policy string | The exact policy the sender applied, as they saw it |
| MX host | Which of your hosts this row concerns |
| Successful session count | Deliveries that satisfied the policy |
| Failed session count, by type | The useful part |
| Sending IP and receiving IP | For the failing sessions |
Note the policy string. A report echoes back the policy the sender actually fetched, which is how you find out that half the internet is holding a version of your policy you replaced last week.
What it lets you answer
- Is anyone enforcing my policy? Successful session counts by sender.
- Is my new MX host failing? Failures naming that host specifically.
- Is my certificate about to cause problems? Validation failures appearing before expiry.
- Can I move from testing to enforce? A period with zero failures is the criterion.
What it does not cover
- Only senders that implement TLS-RPT report. A meaningful share of mail arrives from systems that do not, and is invisible here.
- It is about inbound mail to you. Your own outbound transport problems appear in other people’s reports, not yours.
- No message content or recipients, for the same reasons DMARC aggregate reports carry none.
Publish TLS-RPT before MTA-STS, not after
The reports work regardless of whether you have a policy — a no-policy-found report still tells you who is delivering to you and whether TLS succeeded. Publishing it first gives you a baseline to compare against once the policy goes up, and it is a single TXT record with no failure mode.