/**
* MTA-STS (RFC 8461) + TLS-RPT (RFC 8460) helpers. Two parts:
*
*  - `generateMtaStsPolicy(...)` produces the text file you serve at
*    `https://mta-sts.<domain>/.well-known/mta-sts.txt`.
*  - `parseTlsRpt(json)` normalizes TLS-RPT JSON reports into a typed
*    record.
*
* DNS side (the TXT records at `_mta-sts.<domain>` and `_smtp._tls.<domain>`)
* stays your responsibility — it's one line per domain.
*
* @module
*/
export interface MtaStsPolicyOptions {
	mode: "enforce" | "testing" | "none";
	/** Authorized MX patterns. */
	mx: ReadonlyArray<string>;
	/** Policy lifetime in seconds. RFC 8461 recommends ≤ 604800 (7 days). */
	maxAgeSeconds: number;
}
/** Produce the RFC 8461 policy body. */
export declare function generateMtaStsPolicy(options: MtaStsPolicyOptions): string;
export interface TlsRptReport {
	organizationName?: string;
	dateRange?: {
		start: Date;
		end: Date;
	};
	contactInfo?: string;
	reportId?: string;
	policies: ReadonlyArray<TlsRptPolicy>;
}
export interface TlsRptPolicy {
	policyType?: "tlsa" | "sts" | "no-policy-found";
	policyDomain?: string;
	totalSuccessful?: number;
	totalFailure?: number;
	failureDetails?: ReadonlyArray<{
		resultType?: string;
		sendingMtaIp?: string;
		count?: number;
	}>;
}
/** Parse a TLS-RPT JSON report. Accepts a string or already-parsed
*  object; normalizes camelCase fields. */
export declare function parseTlsRpt(input: string | Record<string, unknown>): TlsRptReport;