{"id":"4aca29bc-6ab9-49ef-96ca-a7255a6d190e","task":"Ingest TLS-RPT (SMTP TLS Reporting) reports to diagnose delivery failures","domain":"ietf.org","steps":["Publish a TXT record at _smtp._tls.yourdomain.com with the content v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.com (or an HTTPS endpoint URL starting with https://) to receive daily reports from sending mail servers.","Sending servers deliver reports as gzip-compressed JSON attachments (.json.gz) via email or as POST requests to your HTTPS endpoint with Content-Type application/tlsrpt+gzip.","Each JSON report contains the sending organisation, the reporting period, your applied policy type (mta-sts, dane, or no-policy-found), and per-policy counts of successful and failed TLS sessions with machine-readable failure types.","Parse the failure_details array: each entry includes result-type (for example starttls-not-supported, certificate-expired, validation-failure), sending-mta-ip, and failed-session-count; prioritise recurring failures from high-volume senders.","Map result-type values to remediation actions: certificate-expired means renew your inbound MX certificate; starttls-not-supported indicates a sending server that cannot negotiate TLS and may require policy mode adjustment; validation-failure often points to a hostname mismatch.","Retain parsed reports for at least 30 days for trend analysis; a sudden spike in failed-session-count after an MX change is a leading indicator of a misconfiguration before users report delivery issues."],"gotchas":["TLS-RPT covers inbound TLS negotiation to your MX hosts, not outbound—it does not replace DMARC aggregate reports and provides no visibility into authentication results.","Reports arrive with a one-day lag (they cover the previous UTC day); TLS-RPT is a monitoring tool, not a real-time alerting mechanism, so pair it with certificate expiry alerts for faster incident response.","Some sending servers do not yet implement RFC 8460 TLS reporting; the absence of reports does not guarantee zero TLS failures—validate TLS configuration independently with tools like MxToolbox or SSL Labs."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:33.723Z"},"url":"https://mcp.waymark.network/r/4aca29bc-6ab9-49ef-96ca-a7255a6d190e"}