SMTP TLS Reporting (TLSRPT) is a mechanism through which you can receive reports and statistics about failures in delivering email securely to your domain.

It is therefore a useful tool to identify issues with the delivery of incoming email.

TLS reporting works best together with MTA-STS (see below) and/or DANE, two mechanisms that help enforce secure email delivery.

To learn more about TLSRPT, read our Introduction to TLSRPT.

Availability

  • TLSRPT monitoring is included with all paid plans. It is not available in the free plan.

Permissions

  • All team members can view the domains and their status.
  • Only team members with a role of Member, Admin or Owner can manually refresh the validation status of a domain.

How to set up TLSRPT

Setting up TLS reporting with DMARCwise is easy. First, make sure you’re subscribed to a paid plan, as this feature is not available to free users.

From the dashboard:

  • Choose a domain from the list.
  • Select the SMTP TLS tab.
  • You’ll be provided with instructions on how to create the TLSRPT DNS record.

Specifically, the record looks like this:

  • Record type: TXT
  • Name: _smtp._tls (or _smtp._tls.{your domain})
  • TTL: 3600

The value of the record is different for every domain so it will be provided in the dashboard.

If you already have a TLSRPT record, this procedure will replace it with a new one. We recommend using only one TLS reporting URI at a time, since some email providers don’t support sending multiple reports.

Organization-wide reporting address

By default, each domain has its own TLS reporting address. You can enable a single address that works for every domain under Organization settings → Reporting address.

The organization-wide address can be used in the rua field of any TLSRPT record. It’s recognizable by the 14-character token after rua+, which begins with o-, for example mailto:rua+o-6qn6u6zwi4k4@dmarcwise.email.

It’s especially useful when managing DNS with shared templates or automation, and DMARCwise will automatically route each report to the correct domain.

How to set up MTA-STS

MTA-STS is a mechanism that lets you require secure connections for email delivered to your domain. It protects against attacks that try to downgrade an encrypted SMTP connection or redirect mail to an unauthorized server.

To learn more about the protocol, visit our Introduction to MTA-STS article.

DMARCwise can host the MTA-STS policy for your domains, manage HTTPS certificates and keep the MX server list up to date. See Setting up hosted MTA-STS for instructions.

If you prefer to operate the policy host yourself, follow our manual MTA-STS setup guide.