What is a TLS-RPT record?

TLS-RPT (RFC 8460) is the reporting half of MTA-STS. It is a DNS TXT record (v=TLSRPTv1 plus a report destination) published at _smtp._tls.yourdomain. Sending mail servers that enforce your MTA-STS policy deliver aggregate TLS failure reports to the address you name in it.

What does the rua tag do?

The rua= tag names where senders deliver aggregate TLS failure reports — a mailto: address or an https: endpoint. Without rua=, senders have nowhere to send reports, so the record collects nothing even though it parses as valid.

Do I need ruf as well as rua?

ruf= names where failure reports go; rua= names where aggregate reports go. rua= alone is enough for almost everyone — it is the destination most senders actually deliver to. Add ruf= only if you have a system that consumes per-failure reports.

Where do I publish the TLS-RPT record?

Publish it as a DNS TXT record at _smtp._tls.yourdomain (for example _smtp._tls.example.com), not at the domain root. The generator gives you the exact record name and value to paste into your DNS provider.

Do I need MTA-STS for TLS-RPT to work?

TLS-RPT without an MTA-STS policy collects almost nothing: senders only generate TLS failure reports while they are enforcing a policy for your domain. Publish both — the MTA-STS policy first, then TLS-RPT — and re-run the checker once DNS propagates.

Free TLS-RPT Generator: No Signup, Browser-Only

Generate your record

Enter your domain and where TLS failure reports should go. The generator assembles the v=TLSRPTv1 TXT record you publish at _smtp._tls + your domain. It runs entirely in your browser — nothing is sent anywhere.

Record ready? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

After you publish

Publish the TXT record at _smtp._tls + your domain (for example _smtp._tls.example.com) — not at the domain root.
Pair it with an MTA-STS policy — senders only generate TLS failure reports while they are enforcing a policy for your domain. If you do not have one yet, build it with the free MTA-STS record generator first.
Confirm the record is live — query _smtp._tls.yourdomain from any DNS lookup after DNS propagates (minutes to hours).

Verify the record with the TLS-RPT checker — once DNS propagates, confirm the v=TLSRPTv1 record parses and your report destination is valid.
Run the Free Email Domain Trust Checker

Publish it at your DNS provider

The DNS record is the same everywhere: a TXT record at _smtp._tls + your domain (for example _smtp._tls.example.com), pasting the value from the generator. Only the buttons differ. Three common providers:

Cloudflare — Dashboard, your domain, DNS, Records, Add record. Type: TXT. Name: _smtp._tls. Content: paste the generated record. TTL: Auto. Save.

GoDaddy — My Products, DNS next to your domain, Add. Type: TXT. Host: _smtp._tls. TXT Value: paste the generated record. Leave the TTL default. Save.

Amazon Route 53 — Hosted zones, your domain, Create record. Record name: _smtp._tls. Record type: TXT. Value: paste the generated record inside double quotes (Route 53 requires them). Save.

Then confirm the foundation is actually solid: TLS-RPT reports on the connection layer, but that layer sits on top of working SPF, DKIM, and DMARC. Run the Free Email Domain Trust Checker and confirm your authentication foundation before you harden transport.

See Every Inbound TLS Failure

Generate your record

After you publish

Publish it at your DNS provider

Keep Exploring