Can senders reach you over encrypted TLS
Senders report when they could not deliver to you securely — problems that are invisible from both ends without this.
Included with Smoo AI Support - Pro, Smoo Workforce + Support Bundle and 5 more plansSee plans
DMARC tells you whether mail claiming to be you authenticated. This answers a different question: when someone sends mail TO you, can they reach your servers over a trusted, encrypted connection?
The failures it catches are ones nobody will otherwise tell you about. An expired certificate on your mail server looks like a delivery problem from the sender’s side and like silence from yours — no bounce arrives, and mail may quietly fall back to being sent unencrypted. Senders publish these reports because the standard (RFC 8460) asks them to.
How to
- 1
Copy the TLS reporting record from Destinations and publish it.
A TXT record at _smtp._tls.<your-domain>. It uses the same reporting address as DMARC.
- 2
Wait about 24 hours for the first reports.
Senders batch these daily, exactly like DMARC.
- 3
Read the TLS success rate, then any failure reasons underneath it.
Each reason is shown in plain language along with the mail servers it was seen against.
If something goes wrong
- The page says no TLS reports received.
- That is not a clean result — it means nobody is reporting. Check the TXT record at _smtp._tls.<your-domain>. Unlike DMARC, nothing else needs authorising: that one record is the entire setup.
- Failures say certificate-expired or certificate-host-mismatch.
- These are on your receiving side. The certificate your mail server presents has either lapsed or does not cover the hostname your MX records point at. Whoever runs your mail hosting fixes it; the report names the exact hosts.
- Failures say starttls-not-supported.
- A server handling your mail is not offering encryption at all, so messages to it travelled in the clear. Worth escalating to your mail provider.