Last updated: July 2026
In short: After this guide your domain at OVHcloud publishes a TLS-RPT record and receives daily reports on encrypted delivery.
Prerequisites
- A domain whose DNS zone is hosted at OVHcloud (“OVHcloud DNS servers in use for the domain name concerned”)
- A destination for the reports (an analysis service or a dedicated mailbox)
- Access to the OVHcloud Control Panel
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting, RFC 8460) is a DNS TXT record under _smtp._tls.your-domain. Receiving mail servers send daily aggregate reports on TLS delivery to the address named there. TLS-RPT enforces nothing — it’s a diagnostic that shows you whether TLS delivery to your domain is working and whether an MTA-STS policy is being honoured. It’s the companion to MTA-STS at shared hosts.
The starting point at OVHcloud
OVHcloud has no dedicated TLS-RPT wizard — but it doesn’t need one. TLS-RPT is a plain TXT record, and you add it through the same DNS-zone assistant you use for any other record. OVHcloud’s editing guide describes it: click Add an entry and follow the steps.
Step-by-step guide
1. Set the report address
The rua address receives JSON reports. Point it at a TLS-RPT analysis service, or at a dedicated mailbox you’ll actually read.
2. Create the TXT record
In the OVHcloud Control Panel, open Web Cloud → DNS zone for your domain and click Add an entry. Choose the TXT record type and enter:
| Field | Value |
|---|---|
| Type | TXT |
| Sub-domain | _smtp._tls |
| Value | v=TLSRPTv1; rua=mailto:tlsrpt@example.com |
3. Together with MTA-STS
TLS-RPT only reports; the actual enforcement of encrypted delivery comes from MTA-STS. Combine the two — see MTA-STS at shared hosts.
4. Wait until the change is live
OVHcloud allows “maximum of 24 hours for the changes to propagate” fully. Give it time before judging the result.
Verify the result
Check your configuration with the free MXAudit scanner.
dig TXT _smtp._tls.example.com +shortThe output must contain exactly one record with v=TLSRPTv1.
Common mistakes
Wrong sub-domain. The record belongs at _smtp._tls, not on the bare domain. Watch OVHcloud’s target-punctuation quirk too: for URL-style targets, “your domain name will be automatically added to the end of your target” if you forget the trailing dot — but for a TXT value that’s not an issue, just don’t put the full hostname in the sub-domain field.
rua to a normal mailbox. The reports are JSON and arrive daily. Use an analysis service or a mailbox dedicated to them.
TLS-RPT without MTA-STS. TLS-RPT only reports; it enforces nothing. The enforcement is delivered by MTA-STS.
Further reading
- OVHcloud: Editing an OVHcloud DNS zone (retrieved: July 10, 2026)
- RFC 8460 — SMTP TLS Reporting