Help & Troubleshooting
TLSRPT
What this is
TLSRPT (published at _smtp._tls.yourdomain.com) tells sending servers where to deliver daily aggregate reports about TLS failures they encountered when sending you mail. It is the visibility companion to MTA-STS.
How to read your result
A valid record has v=TLSRPTv1 and a rua= destination (mailto: or https:). Without MTA-STS it still works — you simply learn about TLS problems you cannot yet enforce against.
Common problems and how to fix them
No TLSRPT while running MTA-STS
How it shows up: If enforce mode ever blocks legitimate mail, you find out from angry senders instead of from reports.
How to fix it: Publish "v=TLSRPTv1; rua=mailto:[email protected]" before tightening MTA-STS, and review the reports during the testing phase.
Report destination rejects the reports
How it shows up: The mailbox bounces the (sometimes large) gzipped JSON attachments, or a filter eats them.
How to fix it: Use a dedicated address or an https: endpoint; whitelist the reports and confirm size limits accommodate them.