Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

TLS-RPT published

Mail encryption reports (TLS-RPT)

Will the domain hear about failed encrypted deliveries?

Why it matters

TLS-RPT asks sending servers to report delivery attempts that failed encryption, which is how a domain notices an interception attempt or a broken certificate before mail is lost.

When a domain passes

Passes when a valid TLS-RPT record names at least one reporting address. Applies only to domains that receive mail.

How to fix it

  1. Publish a TLS-RPT TXT record with a mailbox or an HTTPS endpoint that collects the reports.
  2. Read the reports regularly, or send them to a service that summarises them.

An example record

_smtp._tls.example.com  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

Reference specifications

All thirteen standards