TLS-RPT Report Parser

Parse TLS aggregate reports into failure-level rows for delivery diagnostics, certificate triage, and MTA-STS monitoring.

Inputs

• reports: TLS-RPT JSON in RFC-style kebab-case or camelCase form.
• reportUrls: Public JSON report URLs. The zero-config input reads the RFC 8460 standards example directly from the RFC Editor.
• timeoutMs: Per-source request timeout.
• maxReports: Maximum paid failure rows to emit.
• includeReport: Create Markdown and JSON report artifacts.
• maxChargeUsd: Stop before the next PPE event would exceed the run budget.

{
  "reportUrls": ["https://www.rfc-editor.org/rfc/rfc8460.txt"],
  "timeoutMs": 15000,
  "maxReports": 1,
  "includeReport": true,
  "maxChargeUsd": 1
}

Dataset

Each paid row contains report identity, organization, date range, policy type/domain, result type, sending MTA IP, receiving MX host, reason code, failed and successful session counts, and a compact summary. Reports with no failure details produce no dataset rows.

Billing

The pay-per-event billing events are actor-start, domain-audited, record-extracted, finding-emitted, and audit-report-generated. Dataset and report output is charge-gated. A zero-dollar cap emits no paid output.

Use Cases

• Normalize TLS-RPT failures across reporting organizations.
• Prioritize certificate and STARTTLS failures by session count.
• Group receiving-MX failures for delivery engineering.
• Track MTA-STS policy failures over report windows.
• Export failure evidence with a buyer-ready report.

Limitations

The actor parses supplied aggregate report JSON and public JSON report URLs. It does not retrieve reports from mailboxes, decompress attachments, or infer failures when a policy contains no failure details. The RFC Editor URL is handled as the standards-backed zero-config example.