TLS-RPT Checker
Validate the TLS-RPT reporting record.
Enter a domain to look up its TLS-RPT record and see where reports about failed or downgraded TLS delivery are sent. We read the live record straight from DNS over an encrypted connection. Nothing is stored.
This tool reads the TLS-RPT (SMTP TLS Reporting, RFC 8460) record published as a DNS TXT entry at _smtp._tls.<domain> and confirms it is well formed. TLS-RPT is the feedback channel for transport-encryption policies: it asks sending mail servers to send you daily aggregate reports about whether they could establish secure, policy-compliant TLS connections to your inbound mail hosts.
What a valid record contains
The record must begin with v=TLSRPTv1 followed by an rua= tag listing one or more report destinations. Destinations are URIs: a mailto: address, or an https: endpoint that accepts POSTed reports. Multiple destinations are separated by commas. A typical record looks like v=TLSRPTv1; rua=mailto:tls-reports@example.com. The checker flags a missing version tag, an absent or malformed rua, or a second TXT record that would make the policy ambiguous.
Why it matters and how to read reports
TLS-RPT does not enforce anything on its own; it is the visibility layer that makes MTA-STS and DANE safe to deploy. Without it you turn on enforcement blind. The JSON reports show counts of successful and failed sessions and failure types such as certificate-expired, starttls-not-supported, or validation-failure. If you see failures, check the named MX host's certificate validity, that it offers STARTTLS, and that its certificate name matches. Use a monitored mailbox or a parsing service for the rua address, since the volume can be high. DMARC Engine can receive and decode these reports for you alongside your DMARC audit.
Frequently asked questions
Where does the TLS-RPT record live?
It is a DNS TXT record published at _smtp._tls.<domain>. This is a different name from the MTA-STS signalling record at _mta-sts.<domain>, so make sure you are editing the correct host when you add it.
What can I put in the rua tag?
The rua= tag takes one or more report URIs, separated by commas. Each is either a mailto: address or an https: endpoint that accepts POSTed report bundles, for example rua=mailto:reports@example.com,https://example.com/tlsrpt.
Does TLS-RPT enforce encryption?
No. TLS-RPT only requests reports; it does not change how mail is delivered. Enforcement comes from MTA-STS or DANE. TLS-RPT is the monitoring layer that tells you whether those policies are succeeding before and after you switch them on.
How often will I receive reports?
Cooperating senders such as Google and Microsoft send aggregate reports once per day per domain. The reports are JSON documents, usually gzip-compressed, summarising successful and failed TLS sessions over the previous 24-hour window.
Can I have more than one TLS-RPT record?
You should publish exactly one TXT record beginning with v=TLSRPTv1 at that name. Multiple conflicting records can cause receivers to ignore the policy. You can still send reports to several places by listing multiple URIs inside the single rua tag.
A report shows starttls-not-supported. What does that mean?
It means a sender tried to deliver to one of your MX hosts but that host did not advertise STARTTLS, so the session could not be encrypted. Check that the named mail host offers STARTTLS and presents a valid certificate matching its hostname.