What this check looks at
“Reports failed TLS connections to your mail servers, so downgrade attacks are visible.” - the wording shown beside this check while it runs.
TLS-RPT is a DNS record naming an address where other mail providers send daily reports about their attempts to deliver to you over TLS - how many succeeded, how many failed, and why.
Why it matters
It is to MTA-STS what the DMARC reporting address is to a DMARC policy: the part that tells you whether the policy is working. A certificate that expired, an MX host that fell out of the policy, or somebody actively stripping encryption on the path all look identical from your side - silence - until these reports arrive.
What each verdict means here
- Pass
- A reporting address is published.
- Warn
- A record is present but malformed.
- Not applicable
- No record. Not counted against the score.
What to do
- Publish a
_smtp._tlsTXT record withv=TLSRPTv1and a reporting address. - Send the reports somewhere that can process them - they are JSON, and they arrive daily from every provider that talks to you.
- Pair it with MTA-STS. On its own it tells you about failures you have not asked anyone to avoid.
What this check does not do
We do not receive or parse TLS reports for you. This check confirms the address is published, nothing more.