TLS-RPT Setup: How to Publish the _smtp._tls Record
The short answer (what's causing it)
TLS-RPT asks sending servers to email you daily JSON reports about TLS connection successes and failures to your MX. Without it, MTA-STS or DANE issues are invisible.
Step-by-step fix
- Create a TXT at
_smtp._tls.yourdomain. - Set
v=TLSRPTv1; rua=mailto:a mailbox you control. - Verify with the free scan.
- Review reports before switching MTA-STS to enforce.
Record examples (replace example.co.uk with your domain)
_smtp._tls.example.co.uk. TXT "v=TLSRPTv1; rua=mailto:[email protected]"
Examples are illustrative templates, not values for your domain. Test changes at
p=none/ staging first.
Check yours free in seconds
Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: TLS-RPT.
Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.
Frequently Asked Questions
Does TLS-RPT need MTA-STS?
No, but they're designed to be used together.
What format are reports?
Gzipped JSON per RFC 8460.
Related FaultyPacket guides & tools
Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.