Setting up TLS-RPT at webgo — Step-by-Step Guide (2026)

Last updated: July 2026

In short: TLS-RPT (SMTP TLS Reporting) delivers automated diagnostic reports detailing failed transport encryption attempts on incoming email. You enable reporting by creating a TXT record on the _smtp._tls subdomain inside webgo’s DNS management area.

Prerequisites

A webgo web hosting or email plan with an attached domain
Access to the webgo customer portal (https://login.webgo.de) or Webspace-Admin
An email address or monitoring service configured to receive and parse compressed JSON reports

What is TLS-RPT?

TLS-RPT (SMTP TLS Reporting, specified in RFC 8460) is an auditing standard designed for secure transport encryption between mail servers. When external providers (like Microsoft 365 or Gmail) deliver mail to your webgo mail server, they attempt to establish a secure TLS tunnel. If that handshake fails — due to certificate errors, misconfigurations, or active downgrade attacks — TLS-RPT instructs the sending server to generate a diagnostic failure report and send it to you.

As webgo’s technical support notes regarding resource records: Der TXT-Eintrag erlaubt das Speichern von beliebigen Textinformationen. Häufig wird er verwendet, um Domains bei Diensten zu verifizieren oder das E-Mail-Verhalten zu verbessern (SPF, DKIM, DMARC).

When deploying strict email encryption policies like MTA-STS or DANE, TLS-RPT is essential for monitoring delivery stability and identifying potential security anomalies.

The starting point at webgo

You configure the required record right inside your domain’s DNS settings table (Der TXT-Eintrag erlaubt das Speichern von beliebigen Textinformationen. Häufig wird er verwendet, um Domains bei Diensten zu verifizieren oder das E-Mail-Verhalten zu verbessern (SPF, DKIM, DMARC).).

The reporting policy is published as a TXT record attached to the technical subdomain _smtp._tls. The canonical structure of the record is:

v=TLSRPTv1; rua=mailto:tls-reports@example.com

Step-by-step guide

1. Check whether a TLS-RPT policy is already active

Use your terminal to see if your domain currently serves a reporting record:

dig TXT _smtp._tls.example.com +short

If the returned output starts with v=TLSRPTv1;, a reporting policy exists. If the response is blank, continue to create a new record.

2. Open DNS management at webgo

Log in to the webgo customer portal (login.webgo.de), select your package, and open DNS-Verwaltung (DNS management inside your customer portal or in Webspace-Admin under Domain / DNS).

3. Add the TXT record for _smtp._tls

In your domain’s DNS management table, add a new entry with the following configuration:

Type: TXT
Subdomain / Host: _smtp._tls

Text value / Content:

v=TLSRPTv1; rua=mailto:tls-reports@example.com

(Replace tls-reports@example.com with the email address where you want to collect diagnostic reports).

Save your new DNS record.

The components of the TLS-RPT record

Component	Meaning
`_smtp._tls`	Dedicated subdomain queried by external mail servers for your TLS reporting instructions
`v=TLSRPTv1`	Protocol version tag (must strictly be placed at the very beginning of the TXT string)
`rua=mailto:...`	Target URI specifying where daily compressed JSON reports (`.json.gz`) will be delivered

Verification

After saving your record inside webgo’s DNS settings, immediately test your configuration using the free MXAudit scanner — check your TLS-RPT syntax and ensure your reporting endpoint is correctly formatted.

You can also use your terminal to confirm that nameservers are serving your new record:

dig TXT _smtp._tls.example.com +short

The output should show exactly "v=TLSRPTv1; rua=mailto:tls-reports@example.com".

Common mistakes

Placing the record on root (@): If you add the TXT record to your root domain instead of the _smtp._tls subdomain, external mail servers will not discover your reporting instructions (Der TXT-Eintrag erlaubt das Speichern von beliebigen Textinformationen. Häufig wird er verwendet, um Domains bei Diensten zu verifizieren oder das E-Mail-Verhalten zu verbessern (SPF, DKIM, DMARC).).
Omitting the mailto: scheme: The rua= attribute requires the mailto: URI prefix right before your email address. Missing this prefix makes the record invalid.
Directing reports to a personal inbox: Diagnostic reports arrive daily as compressed JSON/GZIP attachments. Send these reports to a dedicated reporting inbox or automated processing dashboard to keep your main inbox clean.