SMTP TLS Reporting (RFC 8460) — receiving MTAs send aggregate reports of TLS connection failures (downgrade attacks, certificate errors, etc.) to domain owners. Generate the _smtp._tls TXT report record.
RFC 8460 §3: rua is the aggregate report mailbox; multiple addresses are supported (comma-separated) and each must be prefixed with mailto:. Use a dedicated mailbox with automated processing.
Add more report recipients, same format.
RFC 8460 §3: the TLS-RPT record is published at _smtp._tls.yourdomain.com and applies to the domain and its subdomains (unless a subdomain has its own record).
TLS-RPT (RFC 8460) is the companion monitoring mechanism for MTA-STS: when a receiving MTA tries to connect to your domain's MX and hits TLS negotiation failures, certificate validation errors or policy errors, it generates an aggregate report (one per day, JSON) sent to the rua address.
Report content: failure timestamps, failure types (e.g. certificate-expired, starttls-not-supported), involved IPs and MX hosts, TLS versions and more — helping admins spot misconfigurations or active attacks.
Record location: TXT record at _smtp._tls.yourdomain.com. Value format: v=TLSRPTv1; rua=mailto:report@example.com.
Deployment tips: use with MTA-STS — run testing mode + TLS-RPT for two weeks, then switch to enforce once no failures appear. TLS-RPT itself enforces nothing; it is a pure monitoring channel with no downgrade risk.
Standards: RFC 8460 (TLS-RPT), RFC 8461 (MTA-STS), RFC 3207 (STARTTLS).