Back to Course
Լight modeDark mode

Introduction to TLS-RPT

In order to make the connection between two communicating SMTP servers more secure and encrypted over TLS, MTA-STS was introduced to enforce encryption and prevent emails from being delivered in cleartext, in case either of the servers does not support TLS. 

However, one problem still remains unaddressed, that is: How to notify domain owners if remote servers are facing issues in email delivery due to failure in TLS encryption? Here is where TLS-RPT comes into play, providing diagnostic reports in order to enable the monitoring and troubleshooting of issues in server communications, such as expired TLS certificates, misconfigurations in email servers, or failure in negotiating a secure connection due to lack of support for TLS encryption.

 
tls-rpt record generator
 

TLS Reports help to detect and respond to issues in email delivery through a reporting mechanism in the form of JSON files. These JSON files can be complicated and indecipherable for a non-technical person.

Enabling TLS-RPT for Your Domain

The process of enabling SMTP TLS Reporting is quite simple. All you need to do in order to enable it is add a TXT DNS record at the correct location, prefixing _smtp._tls. to your domain name. With PowerDMARC however, this can be set up directly from the PowerDMARC UI without you having to make any changes to your DNS!
 

As soon as you enable TLS-RPT, acquiescent Mail Transfer Agents will begin sending diagnostic reports regarding email delivery issues between communicating servers to the designated email domain. The reports are typically sent once a day, covering and conveying the MTA-STS policies observed by senders, traffic statistics as well as information on failure or issues in email delivery.

Course content
Advanced Email Authentication Course