An astonishing 75% of organizations experienced a successful email attack in 2022. While protocols such as MTA-STS have become extremely useful in securing email channels, there is also a need to ensure that these protocols do not lead to false alarms and delivery issues. This is where TLS-RPT comes into the picture. It allows you to detect and correct errors in the email delivery process so that you can prioritize both safety and efficiency.
This guide will help you understand what TLS-RPT is, why it is essential, how it works, and how you can set it up on your domain to strengthen your email security system.
What is TLS-RPT?
TLS-RPT or TLS reporting is a standard that allows servers to report any issues, especially delivery failures, during the TLS encryption process. It is generally used with other security protocols that enforce TLS encryption, including MTA-STS, DANE, and STARTTLS.
If you don’t already know what TLS is:
Transport layer security (TLS) is a common email security protocol used to protect emails from attacks in the delivery process, such as man-in-the-middle (MITM) and downgrade attacks.
Why is TLS-RPT important?
Every email you send goes through multiple servers behind the scenes to finally reach its recipients. It is important to secure this process by enforcing protocols such as MTA-STS, which mandate TLS encryption of emails. TLS-RPT allows you to monitor this process and take the necessary steps to fix any delivery issues.
Suppose you have implemented both MTA-STS and TLS-RPT, and realize that some of your emails are not being delivered. You will receive timely feedback reports indicating the reason for the delivery failure,such as a certificate mismatch.
Subsequently, you may discover that one of your mail servers is presenting an outdated certificate. You can quickly update the certificate and solve the issue.
Therefore, implementing TLS-RPT is a means to troubleshoot delivery issues and ensure that your emails get delivered securely and efficiently.
How does TLS-RPT work?
If you have set up TLS reporting on your domain, you will receive TLS reports whenever an issue is detected in your domain’s TLS configuration and a server cannot send you emails. These reports are sent in JSON format to your specified email address. Here's what the process looks like.
Step 1: TLS handshake
A TLS handshake is the process through which a secure TLS communication is established between the sending and receiving mail transfer agents (MTA). This is done by checking whether both servers support TLS.
Step 2: Error detection
If there is a barrier in establishing a secure TLS connection, the sending server identifies it as an error. Here are a few common TLS errors that may be flagged:
| Error type | Description |
|---|---|
| Certificate mismatch | The certificate presented by the receiving server does not match the expected domain. |
| Expired certificate | The certificate has expired and is no longer valid. |
| Untrusted root | The certificate is not signed by a trusted certificate authority (CA). |
| Weak cipher | The connection uses a cipher suite that is considered insecure. |
| Protocol downgrade | An attacker attempts to downgrade the encryption protocol to a weaker version or plaintext. |
| TLS version mismatch | The sending server and receiving server do not support a common version of TLS. |
Step 3: Report generation
Once the error is identified, the sending server generates a TLS report that details the error and other relevant details. Here is an example of a TLS report:
{
"organization-name": "Sender Organization",
"date-range": {
"start-datetime": "2024-08-01T00:00:00Z",
"end-datetime": "2024-08-01T23:59:59Z"
},
"contact-info": "admin@sender.org",
"report-id": "2024-08-01-01",
"policies": [
{
"policy": {
"policy-type": "sts",
"policy-string": "v=STSv1; id=2024-08-01T00:00:00Z;",
"policy-domain": "example.com"
},
"summary": {
"total-successful-session-count": 100,
"total-failure-session-count": 10
},
"failure-details": [
{
"result-type": "certificate-expired",
"sending-ip": "192.0.2.1",
"receiving-mx-hostname": "mx.example.com",
"receiving-mx-dns": ["mx1.example.com", "mx2.example.com"],
"failed-session-count": 10
}
]
}
]
}
As you can see, a TLS report contains the following key elements:
- Report metadata: This field indicates details about the organization that is sending the report. This includes the name of the reporting organization, report ID, the date range that the report covers and the contact information of the reporting organization.
- Policy details: This field includes details such as your domain, the MX host involved in the email transaction, and the policy string that specifies the TLS requirement.
- Summary information: This section provides the key statistics about email delivery to your domain, including the number of total successful connections, total failed connections, and the failure percentage.
- Failure details: This is the most important section of the report where a more detailed explanation is provided. The field includes details such as the failure type, the sender’s IP address, the name of the receiving MX host, the receiving MX DNS, and the number of failed sessions.
How to implement TLS-RPT
You can implement TLS-RPT through the following steps. You should ideally implement these steps after configuring TLS and MTA-STS for your domain.
Step 1: Create a dedicated mailbox for TLS reports
To set up TLS reporting, you must first create a dedicated mailbox where servers can send you TLS reports. You can do this on your corporate email system or a mail server.
Step 2: Create and publish a DNS TXT record
After you have set up a dedicated inbox for incoming reports, create a DNS record in TXT format for your domain to define your TLS-RPT policy. This record will look something like this:
_host._tlsrpt.example.com. IN TXT "v=TLSRPTv1;
rua=mailto:tls-report@example.com, https://tls-report.example.com/report"
This record contains the following key components:
- The version of the TLS-RPT that is used (v=TLSRPTv1)
- The email address to which reports will be sent (rua=mailto:reports@example.com)
- The HTTPS endpoint which will also receive the reports (https://tls-report.example.com/report)
Step 3: Test your configuration
To ensure that your DNS record is configured correctly, you can use online DNS lookup tools such as MXToolbox or DNSChecker. Additionally, you can also use a testing tool such as Mailhardener
Step 4: Monitor and analyze reports
Once successfully published and tested your DNS TXT record, you will start receiving TLS-RPT reports, which you can access through the inbox of your specified email address or the HTTPS endpoint mentioned in your DNS TXT record.
Conclusion
TLS-RPT is an important tool that allows you to detect and correct various vulnerabilities in your email security and email delivery. However, no single tool or protocol can completely ensure the safety of your emails. It is important to ensure that you have a detailed email security strategy and combine TLS-RPT with various other protocols such as SPF, DMARC, and DKIM. It is crucial that you invest in solid email security systems to combat the ever-evolving cybersecurity threats that can cost you greatly if you do not take adequate precautions.
