gh-christianlouis-dmarq/docs/user_guide/tls_reports.md

TLS Reports

DMARQ can import SMTP TLS Reporting (TLS-RPT) JSON aggregates and summarize delivery security failures alongside the existing DMARC posture views.

Importing TLS Reports

Open TLS Reports and upload a .json, .json.gz, or .zip TLS-RPT attachment. A single file can contain multiple policy domains; DMARQ stores each policy-domain entry independently and skips duplicates by report-id plus policy domain.

Imported reports appear in the same page as:

• daily successful and failed TLS session trends
• top TLS failure causes grouped by result-type
• affected policy domains with failure rates
• receiving MX hostnames and reason codes when reporters include them

API

TLS reporting endpoints require the same admin authentication as other operational endpoints:

• POST /api/v1/tls-reports/upload imports one TLS-RPT attachment.
• GET /api/v1/tls-reports lists stored TLS report policy entries.
• GET /api/v1/tls-reports/summary?domain=example.com&days=30 returns trends, top failure causes, and affected domains.

Retention and Privacy

DMARQ stores only aggregate TLS reporting posture data:

• report ID
• reporting organization and contact info
• policy domain and policy type
• report date range
• successful and failed session counts
• grouped failure result type and failed-session count
• sending MTA IP, receiving MX hostname, HELO, or IP when supplied by the report
• failure reason code and grouped diagnostic text

DMARQ does not store:

• message bodies
• message subjects
• sender or recipient addresses
• recipient local-parts
• raw uploaded attachments
• mailbox credentials or source message identifiers

Use normal database backup and retention processes to control how long imported TLS-RPT aggregates remain available.