TLS-RPT (SMTP TLS Reporting): RFC 8460 Decoded, JSON Telemetry & Failure Ingestion

The Inbound Encryption Blind Spot

While DMARC aggregate reports (RFC 7489) provide comprehensive visibility into sender identity and message authentication, they offer zero diagnostic insight into transport layer encryption. If an MX server certificate expires, if a firewall strips STARTTLS, or if a cipher incompatibility prevents an encrypted socket from forming, domain administrators typically remain oblivious until inbound customer emails fail.

SMTP TLS Reporting (TLS-RPT, RFC 8460) eliminates this visibility blind spot. Published in DNS alongside MTA-STS or DANE, TLS-RPT instructs sending MTAs (including Google, Microsoft, and Comcast) to generate daily machine-readable JSON reports detailing successful encrypted sessions and diagnostic breakdowns of every transport failure.

How TLS-RPT Operates: The Reporting Flow

1. DNS Declaration: The recipient domain publishes a DNS TXT record at _smtp._tls.<domain> declaring reporting endpoints via rua=.
2. Delivery Session Logging: When an external MTA (such as Gmail’s outbound cluster) attempts delivery to the domain’s MX servers, it records TLS handshake metrics, certificate validation results, and policy checks.
3. Report Aggregation & Compression: Every 24 hours, the sending MTA aggregates connection statistics into a standardized JSON payload, compresses it with gzip, and dispatches it via email (mailto:) or HTTPS POST.

TLS-RPT DNS Discovery Record (_smtp._tls)

The TLS-RPT policy is published as a DNS TXT record located at the designated subdomain _smtp._tls.<domain>:

v=TLSRPTv1; rua=mailto:tls-reports@example.com,https://api.example.com/v1/tls-rpt

Deconstructing the RFC 8460 JSON Telemetry Payload

Each report contains structured JSON metadata divided into policies, session counts, and detailed failure arrays:

{
  "organization-name": "Google LLC",
  "date-range": {
    "start-datetime": "2026-10-26T00:00:00Z",
    "end-datetime": "2026-10-26T23:59:59Z"
  },
  "contact-info": "smtp-tls-reporting@google.com",
  "report-id": "2026-10-27-google-to-example.com-001",
  "policies": [
    {
      "policy": {
        "policy-type": "sts",
        "policy-string": ["version: STSv1", "mode: enforce", "mx: mail.example.com", "max_age: 604800"],
        "policy-domain": "example.com"
      },
      "summary": {
        "total-successful-session-count": 48210,
        "total-failure-session-count": 2
      },
      "failure-details": [
        {
          "result-type": "certificate-expired",
          "sending-mta-ip": "209.85.220.41",
          "receiving-mx-hostname": "backup-mail.example.com",
          "receiving-mx-ip": "198.51.100.45",
          "failed-session-count": 2
        }
      ]
    }
  ]
}

The 11 RFC 8460 Result Types & Diagnostic Fixes

Sender Support Matrix: Who Dispatches TLS-RPT Reports?