Safety
TLS-RPT vs MTA-STS for SMTP Failure Reports
March 13, 2026
TLS-RPT vs MTA-STS for SMTP failure reports is telemetry versus policy. MTA-STS (RFC 8461) publishes how sending MTAs should use TLS to your MX. TLS-RPT (RFC 8460) is a DNS TXT on _smtp._tls that names a mailbox or HTTPS endpoint for JSON reports when TLS to that MX fails or policy cannot be applied. DMARC rua is a different report stream about From alignment. A mailbox you never read is not a control. RoastMyOpsec does not query _smtp._tls, does not fetch MTA-STS policy, and does not score missing TLS-RPT as an F.
The practical difference
MTA-STS is the lock you asked senders to honor. TLS-RPT is the smoke alarm. DMARC reports are about spoofing, not SMTP TLS. Website NEL and CSP reports are browser telemetry — different layer. See MTA-STS vs DMARC and NEL vs CSP reports.
HTTPS rua endpoints for TLS-RPT must not require cookies and must not be an open redirect. Keep the mailbox on a domain you actually operate.
How to choose a policy
Ship SPF/DKIM/DMARC first. Add MTA-STS when you control the MX. Add TLS-RPT the same week so you see senders that cannot TLS. Start MTA-STS in testing with reports, then enforce. Do not publish rua to a shared inbox that auto-deletes JSON.
| Control | Job | Failure mode | Takeaway |
|---|---|---|---|
| MTA-STS | SMTP TLS policy to MX | Stale HTTPS policy host | The actual transport policy |
| TLS-RPT | Reports when TLS/policy fails | Mailbox you ignore | Telemetry; not a roast F |
| DMARC rua | From-alignment reports | Unmonitored rua | Different stream |
| Website HTTPS | Browser to origin | Unrelated to MX | Different layer |
When TLS-RPT wins
TLS-RPT wins once MTA-STS exists and someone will read the JSON. MTA-STS still wins as the policy. Missing TLS-RPT on a domain that does not send or receive mail is healthy. Pair with DNS hygiene if _smtp._tls is a dangling CNAME.
What the roast can prove
Nothing about MX or TLS-RPT. The scan is a consented GET to the URL you paste. Confirm TXT records in your mail console. Pair with BIMI only after DMARC is real — that is branding, not SMTP TLS.
Common mistakes
The first mistake is TLS-RPT without MTA-STS and calling the reports a policy.
The second mistake is a rua URL that 302s through a marketing tracker.
The third mistake is treating missing TLS-RPT as a website OPSEC F.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does TLS-RPT replace MTA-STS?
- No. Reports describe failures. MTA-STS is the policy senders should follow.
- Should every marketing domain publish TLS-RPT?
- Only if you operate MX and will read the reports. Missing it is not a roast F.
- Does RoastMyOpsec check TLS-RPT?
- No. It does not query _smtp._tls or parse SMTP TLS reports.