# TLS-RPT

TLS-RPT (RFC 8460) is a DNS record at _smtp._tls.<domain> naming an address where sending servers report failures to deliver over TLS, so a broken MTA-STS policy is seen rather than silent.

Date: 2026-09-13

TLS-RPT, SMTP TLS Reporting, is the mechanism of RFC 8460 by which a receiving domain publishes a TXT record at `_smtp._tls.<domain>` naming an address, or an HTTPS endpoint, where sending servers send daily reports of connections they could not secure — an expired certificate, a hostname that does not match, an MTA-STS policy they could not fetch. It is the feedback loop that makes a strict transport policy safe to switch on.

## What Spaw answers

The domain endpoint reports `tls_rpt`: whether the record exists. True means someone at the domain will hear when TLS delivery fails; false is a checked negative; null means the lookup failed.

## What it does not mean

A reporting address says nothing about whether TLS is enforced — that is MTA-STS — and the reports go to the domain's own operators, not to the sender. It is a sign of a maintained domain, not a delivery guarantee.

Reference: https://spaw.co/glossary/tls-rpt