Publish a TLS-RPT record on Cloudflare

Why it matters

TLS-RPT sends you daily reports from mail servers that failed to deliver to you over TLS, which is how you find a broken MTA-STS policy or an attack. It costs one DNS record and makes moving MTA-STS to enforce mode much safer.

The fix

1. In the Cloudflare dashboard open DNS > Records > Add record. Type TXT, Name _smtp._tls, Content v=TLSRPTv1; rua=mailto:your-mailbox, save. TXT records are never proxied.
2. Create the mailbox first; reports arrive daily from many mail providers.

Type:     TXT
Name:     _smtp._tls.example.com
Content:  v=TLSRPTv1; rua=mailto:tls-reports@example.com
TTL:      Auto

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Fix the TLS-RPT record