[ Transport security ]
No TLS reports arriving: check support, traffic and collection
Separate missing sender observations from discovery, delivery, integrity, parsing and dashboard failures when TLS reports are absent.
By the EmailAuth research team · 8 min read
[ Key points ]
- Silence does not distinguish unsupported senders from a broken collector.
- Trace discovery, ingress, validation, parsing and display separately.
- Use report-internal time ranges and evidence before changing DNS.
[ Takeaway ]
Find the missing stage using traffic, participation and collection evidence instead of treating an empty chart as proof of a transport failure.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Locate the missing stage
A report can arrive yet never appear in a dashboard.
Next steps
- Check public discovery and actual receiving traffic.
- Trace the report id through mailbox or HTTP ingress.
- Preserve parser and filter outcomes.
CISO / SecOps
Keep integrity checks intact
Missing data does not justify accepting unauthenticated or unsafe reports.
Next steps
- Retain required DKIM validation for SMTP reports.
- Treat payloads as untrusted input.
- Record coverage gaps without declaring universal success.
Founder / Non-technical
Set a defensible reporting expectation
Low traffic and optional participation can produce legitimate quiet periods.
Next steps
- Identify expected senders and business traffic.
- Assign ownership for each collection stage.
- Require an evidence-based closure decision.
[ FAQs ]
Frequently asked questions
Does no TLS-RPT data prove MTA-STS is disabled?
No. Reporting and enforcement are separate. Sender participation, traffic and collector behavior can explain silence independently of transport policy.
How quickly should a new record produce a report?
There is no universal deadline. Reports should cover a UTC day and be delayed; generation depends on participation and observed traffic.
Will flushing my local DNS cache help external reporters?
It does not clear other systems’ caches. Compare authoritative publication and relevant recursive observations with timestamps.
Can a mailbox contain a report that the collector ignores correctly?
Yes. SMTP reports lacking a valid required DKIM signature must be ignored; other documented integrity conditions can also affect acceptance.
Does one test email prove the collector works?
An ordinary email does not prove that report MIME, compression, signature validation and parsing work end to end. Label the scope of each proposed test.
Should I expect reports at every configured URI?
No. A reporter may deliver to only one supported destination. Check other approved endpoints before declaring all reporting broken.
Which time range controls when filename and report disagree?
The report itself is authoritative when filename or subject metadata disagrees. Inspect its internal interval and dashboard time-zone filters.
What happens if two valid TLS-RPT policy records are published?
After discarding TXT resource records that do not begin with the literal prefix "v=TLSRPTv1;", the sender must find exactly one remaining record. If it finds zero or more than one, RFC 8460 requires it to assume TLS-RPT is not implemented. Record boundaries matter: multiple strings within one TXT record do not by themselves mean multiple policy records.
[ Sources ]
Sources
[ Glossary ]
Glossary
- Participation
- Whether a sending system generates TLS-RPT observations for the relevant traffic.
- Ingress
- The stage at which a mailbox or HTTP collector receives the report.
- Attribution
- The process of associating parsed observations with the correct policy domain and account.
- Coverage gap
- An interval or sender population for which usable reporting evidence is absent.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption