TLSRPT report
also: SMTP TLS Reporting, RFC 8460
TLSRPT (SMTP TLS Reporting) is a protocol that allows email servers to share reports about TLS connection failures and successes with domain owners, helping identify and diagnose email delivery issues.
TLSRPT is defined in RFC 8460 and works alongside SMTP to provide visibility into encrypted email transmission. When an email server attempts to deliver mail to another server, it tries to establish a TLS (Transport Layer Security) connection. If that connection fails or succeeds, TLSRPT allows the sending server to report this event back to the recipient domain's specified reporting address.
Domain owners publish a TLSRPT policy in their DNS records (as a _smtp._tls.example.com TXT record) that specifies where these reports should be sent. This enables administrators to detect man-in-the-middle attacks, certificate problems, server misconfigurations, or other TLS issues affecting email delivery.
For example, if mail.example.com tries to send an email to [email protected] but cannot establish a TLS connection to company.com's mail server, it will generate a TLSRPT report and send it to the address specified in company.com's TLSRPT DNS policy, allowing company.com's administrators to investigate the problem.