Last updated: July 2026
In short: After this guide your Route 53 hosted zone publishes a TLS-RPT record and receives daily reports on encrypted delivery.
Prerequisites
- A public hosted zone in Amazon Route 53
- A destination for the reports (analysis service or mailbox)
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting, RFC 8460) is a DNS TXT record under _smtp._tls.your-domain. Receiving servers send daily aggregate reports on TLS delivery to the address named there. It enforces nothing — it shows you whether your MTA-STS or DANE protection works. As a pure DNS service, Route 53 is ideal for publishing it.
Step-by-step guide
1. Set the report address
A TLS-RPT analysis service processes the JSON reports and turns them into a readable overview.
2. Create the TXT record in the Route 53 console
Open your hosted zone and choose Create record:
| Field | Value |
|---|---|
| Record name | _smtp._tls |
| Record type | TXT |
| Value | "v=TLSRPTv1; rua=mailto:tlsrpt@beispiel.de" |
The Route 53 rule applies as for every TXT record: the value goes in double quotes (“A TXT record contains one or more strings that are enclosed in double quotation marks”). The record name is the subdomain _smtp._tls — for the root domain you’d leave the name empty, but here the subhost belongs in it. Then choose Create records.
3. Together with MTA-STS or DANE
TLS-RPT only reports; the actual enforcement of encrypted delivery comes from MTA-STS or — with a DNSSEC-signed zone — DANE. Combine TLS-RPT with one of them so you also get feedback on how the enforcement performs.
4. Wait until the change is live
Per the AWS docs, “Changes generally propagate to all Route 53 name servers within 60 seconds” — resolver caches follow once the TTL expires.
Verify the result
Check your configuration with the free MXAudit scanner.
dig TXT _smtp._tls.example.com +shortCommon mistakes
Forgot the quotation marks. In the Route 53 Value box the TXT value goes in double quotes.
rua to a normal mailbox. The reports are JSON — use an analysis service, not your personal inbox.
TLS-RPT alone. It only reports; enforcement is delivered by MTA-STS or DANE.
Further reading
- Amazon Route 53 Developer Guide: Supported DNS record types (retrieved: July 10, 2026)
- Amazon Route 53 Developer Guide: Creating records using the console (retrieved: July 10, 2026)
- RFC 8460 — SMTP TLS Reporting