TLS-RPT Checker
Check SMTP TLS Reporting DNS record. Validate TLS-RPT configuration and reporting URI setup.
Frequently Asked Questions
What is TLS-RPT?
TLS-RPT (TLS Reporting) is an email standard defined in RFC 8460 that allows domain owners to receive daily reports about TLS connectivity failures experienced by sending mail servers when delivering email to their domain. Reports are sent to an address specified in a TXT record at _smtp._tls.yourdomain.com. TLS-RPT works alongside MTA-STS and DANE to provide visibility into mail delivery failures caused by TLS problems.
What does a TLS-RPT report contain?
TLS-RPT reports are JSON-formatted files (often gzip-compressed) sent by participating mail providers. Each report covers a 24-hour period and includes: the number of successful TLS connections, the number of failures, the type of failure (certificate mismatch, expired certificate, MTA-STS policy failure, DANE failure, etc.), and details about the sending MTA. Major providers like Google and Microsoft send TLS-RPT reports if you publish the record.
How do I set up TLS-RPT?
Publish a TXT record at _smtp._tls.yourdomain.com with the value v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com. Replace the email address with one you control and can receive reports at. The rua value can also be an HTTPS endpoint that accepts POST requests. TLS-RPT reports are typically sent once per day, per sending domain that attempted delivery to your MX servers.
Do I need MTA-STS to use TLS-RPT?
No — TLS-RPT can be used independently of MTA-STS. It also works with DANE (DNS-based Authentication of Named Entities) or can simply provide visibility into generic TLS failures. However, TLS-RPT is most valuable when used alongside MTA-STS or DANE, as it gives you feedback on whether your policy is causing delivery problems before you switch to enforce mode. Publishing TLS-RPT is low risk and provides useful diagnostics regardless of your other email security setup.