Last updated: July 2026
In short: After this guide your domain at Strato publishes a TLS-RPT record and receives daily reports on encrypted delivery.
Prerequisites
- A domain at Strato with access to the customer login
- A destination for the reports (analysis service or mailbox)
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting, RFC 8460) is a DNS TXT record under _smtp._tls.your-domain. Receiving mail servers send daily aggregate reports on TLS delivery to the address named there. TLS-RPT enforces nothing — it shows you whether your MTA-STS protection works.
The starting point at Strato
TLS-RPT is a normal TXT record — Strato has wizards for predefined SPF rules, but you simply enter TLS-RPT by hand.
Step-by-step guide
1. Set the report address
A TLS-RPT analysis service processes the JSON reports.
2. Create the TXT record
In the customer login, open the Domain management. In the domain overview, choose the gear for the domain. On the following page, click the DNS tab and then manage the TXT and CNAME records. Create:
| Field | Value |
|---|---|
| Type | TXT |
| Prefix | _smtp._tls |
| Value | v=TLSRPTv1; rua=mailto:tlsrpt@beispiel.de |
Note Strato’s quirk: the prefix is automatically extended with your domain name — enter only _smtp._tls, not the full name.
3. Together with MTA-STS
Combine TLS-RPT with MTA-STS at Strato.
4. Wait until the change is live
DNS changes take a few hours depending on TTL.
Verify the result
Check your configuration with the free MXAudit scanner.
dig TXT _smtp._tls.example.com +shortCommon mistakes
Full hostname in the prefix field. Strato adds the domain automatically — otherwise you get _smtp._tls.example.com.example.com.
rua to a normal mailbox. Use an analysis service.
TLS-RPT without MTA-STS. It only reports; enforcement is delivered by MTA-STS.
Further reading
- Strato FAQ: Managing DNS entries (German) (retrieved: July 10, 2026)
- RFC 8460 — SMTP TLS Reporting