TLS-RPT Checker

Check TLS reporting

TLS-RPT tells senders where to report failed TLS connections to your mail servers. Check that the record exists and its report destinations are valid.

Guide

What the TLS-RPT checker tests

SMTP TLS Reporting (RFC 8460) is the feedback loop for MTA-STS and DANE. Senders that support it send a daily JSON report of how many TLS connections to your MX hosts succeeded and why the others failed.

  • The record at _smtp._tls.your domain must start with v=TLSRPTv1, and there must be exactly one.
  • rua= lists one or more destinations, each a mailto: address or an https: URL, comma-separated.
_smtp._tls.example.com.  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

FAQ

TLS-RPT: common questions

What is TLS-RPT?

TLS-RPT (SMTP TLS Reporting, RFC 8460) is a DNS record that tells sending mail servers where to send daily reports about TLS connection failures when delivering to your domain. It shows when MTA-STS, DANE or certificate problems are affecting delivery.

Who sends TLS-RPT reports?

Large mailbox providers including Google and Microsoft send them. Reports arrive once a day per sending organisation, as JSON, usually gzipped.

Is TLS-RPT useful without MTA-STS?

Yes. Reports still show how often senders failed to negotiate TLS with your servers. But it is most valuable alongside MTA-STS or DANE, where a TLS failure means mail is not delivered.

Guides

Learn more

  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.