Check · Domain & email identity · default severity info
TLS reporting (TLS-RPT)
What Kavach checks
Asks sending servers to report TLS delivery failures to you.
Why it matters
You can't fix mail-transport problems you never hear about.
How to fix it
Add: _smtp._tls TXT "v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain"
Stack-specific fixes: nginx · Apache · Caddy · Express / Node · Cloudflare
Limitations
This is a read-only observation of publicly reachable configuration at scan time. It can produce false positives/negatives (caching layers, geo-specific responses, bot defences) and does not test application logic or authenticated areas. Rule version 1.