TLS-RPT Settings
This page manages TLS-RPT Reporting and MTA-STS Record & Policy Hosting for a domain. TLS-RPT and MTA-STS work together to monitor and enforce secure (TLS) delivery of email to your domain. Each requires its own DNS record, so DMARC Manager guides you through setup and verification separately for TLS-RPT, the MTA-STS record, and the MTA-STS policy.
Note: TLS-RPT and MTA-STS each require their own DNS record to be added and verified. Until a record is verified, its section shows a pending status.
TLS-RPT Reporting
When TLS-RPT Reporting is disabled, the page shows the heading TLS-RPT Reporting is Disabled with an Enable TLS-RPT Reporting button. Confirming this in the dialog turns reporting on for the domain.
Once enabled, the TLS-RPT Reporting section shows:
| Element | Description |
|---|---|
| Verification status | Shows whether the TLS-RPT DNS record has been found and verified, and when it was last checked. |
| Verify | Re-checks DNS for the TLS-RPT record right away. |
| Setup Instructions | Opens the TLS-RPT DNS record details so you can add or update the record with your DNS provider. |
| Reports Will be Sent to | The email addresses that receive TLS-RPT reports. Add or remove recipients here. |
TLS-RPT Setup Instructions
Selecting Setup Instructions opens the TLS-RPT panel, which shows the CNAME record (host _smtp._tls) to add at your DNS provider, along with:
| Element | Description |
|---|---|
| Configure DNS with Entri | Automatically sets up the record with your DNS provider through Entri, without you needing to log in to your DNS provider manually. Only shown when Entri is available for your account. |
| Share Setup Instructions | Generates a link to share the DNS setup steps with someone else, such as a colleague who manages your DNS. |
| Verify | Checks DNS for the record after you've added it. |
| View Raw TLS-RPT Record | Shows the raw TXT record value as an alternative to the CNAME method. |
MTA-STS Record & Policy Hosting
When MTA-STS Hosting is disabled, the page shows the heading MTA-STS Hosting is Disabled with an Enable MTA-STS Hosting button. Confirming this in the dialog turns on record and policy hosting for the domain.
Once enabled, this section covers both the MTA-STS Record and the MTA-STS Policy, each independently verified.
MTA-STS Record
| Element | Description |
|---|---|
| Verification status | Shows whether the MTA-STS record has been found and verified ("Record Verified" or "Record Pending Verification"), and when it was last checked. |
| Verify | Re-checks DNS for the MTA-STS record right away. |
| Setup Instructions | Opens the MTA-STS record details so you can add or update the record with your DNS provider. |
Selecting Setup Instructions opens the MTA-STS Record panel, showing the CNAME record to add, plus Configure DNS with Entri, Share Setup Instructions, Verify, and View Raw MTA-STS Record, as described above for TLS-RPT.
Policy Enforcement Level
The policy of MTA-STS can be configured by changing the Policy Enforcement Level:
| Level | Description |
|---|---|
| None | No enforcement of TLS for email transport. |
| In Testing | Default (Recommended) — Monitors TLS usage without enforcing it. |
| Enforced | Enforces TLS for email transport, blocking emails that do not meet the TLS requirements. |
MX Servers
This section displays the MX servers currently configured for your domain's MTA-STS policy. MTA-STS uses these MX server values to define which mail servers are permitted to receive email for your domain over TLS.
To fetch the latest MX records from DNS, click the refresh icon next to MX Servers. The list updates automatically once the refresh completes.
MTA-STS Policy Setup Instructions
Selecting Setup Instructions next to the policy status opens the MTA-STS Policy panel, showing the CNAME record to add, plus Configure DNS with Entri, Share Setup Instructions, Verify, and View Raw MTA-STS Policy Record, as described above.
Note: Verification status for the policy is shown separately as "Policy Verified" or "Policy Pending Verification".
Disabling TLS-RPT or MTA-STS
If either TLS-RPT Reporting or MTA-STS Hosting is enabled, a Disable TLS-RPT Reporting and/or Disable MTA-STS Hosting button is shown. Confirming this in the dialog removes all settings and configuration for that domain — this action cannot be undone.
Related Topics
Read more on TLS-RPT
- What is TLS-RPT? - Introduction to TLS-RPT and its purpose
- How Does TLS-RPT Work? - Technical details about TLS-RPT operation
- Why is TLS-RPT Important? - Benefits and significance of TLS-RPT
- How Does MTA-STS/TLS Work with DMARC? - Integration with DMARC
- TLS-RPT Reporting - Understanding TLS-RPT reporting
- TLS-RPT Domain Report - Understanding TLS-RPT report interface