Analyzer · RFC 8460 · nothing stored
TLS report analyzer
Upload the TLS-RPT reports mail servers send to the address in _smtp._tls. See how many deliveries to the domain used TLS without trouble, which failed, on which MX host and what to fix.
How you get the reports
Publish an
_smtp._tlsrecord withrua=(the MTA-STS generator makes it): servers that send you mail send reports to that address.The reports arrive daily as JSON attachments, usually compressed (
.json.gz). Save them as they are.Upload them here, as many as you like: you get the successful sessions, the failures by type and the MX hosts involved.
TLS reports in brief
- What they contain
A TLS-RPT report (RFC 8460 section 4) says, usually for one UTC day, which policy the sender applied, how many TLS sessions succeeded and the details of the failed ones.
- Failure types
Negotiation problems (no STARTTLS, expired certificate, wrong name, invalid chain), MTA-STS or DANE policy problems, and general failures with a reason code (section 4.3).
- The applied policy
stsmeans MTA-STS,tlsameans DANE, andno-policy-foundthat the sender found neither. A report may contain several policies. - What happens to the files
They are read in memory only, for this answer, then dropped: not written to disk and not in logs. The analysis makes no network query.
Sources: RFC 8460 · RFC 8461 §5