Free TLS-RPT Checker
Verify your domain's TLS-RPT configuration in seconds. One scan checks DNS records, reporting destinations, and STARTTLS support.
Free, no account required. Enter any domain to get started.
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting) is an email security standard defined in RFC 8460. It provides a mechanism for mail servers to report failures in TLS negotiation back to domain owners. Without TLS-RPT, you have no visibility into whether senders can actually establish encrypted connections with your mail servers.
When a sending server tries to deliver email to your domain and encounters a TLS problem (an expired certificate, a failed STARTTLS upgrade, or a policy violation), TLS-RPT ensures you hear about it. Reports are delivered as JSON files, typically once per day, to a destination you specify in your DNS.
The protocol works through a single DNS TXT record at _smtp._tls.yourdomain.com that specifies where reports should be sent using a rua= tag. This can be a mailto: address for email delivery or an https: endpoint for automated processing.
TLS-RPT is designed to work alongside MTA-STS and DANE. While MTA-STS and DANE enforce encryption policies, TLS-RPT gives you the feedback loop to know whether those policies are working as intended across all senders.
What this checker verifies
Our TLS-RPT checker performs a comprehensive scan of your domain's configuration and reports issues with clear explanations.
DNS Record Validation
Verifies that your _smtp._tls TXT record exists, is correctly formatted, and contains a valid v=TLSRPTv1 version tag.
Reporting Destination
Checks that the rua= tag points to a valid reporting destination (mailto: or https: URI) where TLS failure reports will be delivered.
STARTTLS Support
Connects to your MX servers and verifies that they support STARTTLS, which is the encryption mechanism that TLS-RPT monitors.
MTA-STS Alignment
Checks whether your domain also has an MTA-STS policy. TLS-RPT works best alongside MTA-STS, providing visibility into encryption enforcement.
How to set up TLS-RPT
TLS-RPT only requires a single DNS record. It is one of the simplest email security protocols to deploy.
Create the DNS TXT record
Publish a TXT record at _smtp._tls.yourdomain.com with the value "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com" to start receiving reports.
Choose your reporting destination
Reports can be sent via email (mailto: URI) or HTTPS POST (https: URI). Email is simplest to set up. For automated processing, use an HTTPS endpoint.
Set up MTA-STS alongside TLS-RPT
TLS-RPT reports are most useful when paired with MTA-STS. Without an MTA-STS policy, senders have nothing to report against since encryption is only opportunistic.
Monitor incoming reports
TLS-RPT reports arrive as JSON files, typically daily. They detail successful and failed TLS negotiations, helping you identify delivery problems before they affect users.
Why use MailShield for TLS-RPT?
TLS-RPT reports are JSON files that arrive daily from every major email provider. Manually parsing these reports across multiple domains quickly becomes unmanageable. MailShield processes your TLS-RPT reports automatically and surfaces the data that matters.
When you add a domain to MailShield, we provide a managed reporting address. Just point your TLS-RPT rua= tag at it, and MailShield handles ingestion, parsing, and alerting automatically.
- Automatic TLS-RPT report ingestion and parsing
- Clear dashboard showing TLS success rates across all senders
- Alerts when TLS negotiation failures spike
- Combined view with MTA-STS policy status for full encryption coverage
- Historical tracking to spot trends and regressions
- Manage TLS-RPT across all your domains from a single dashboard
TLS-RPT Checker FAQ
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting) is an email security standard defined in RFC 8460 that lets receiving mail servers send you reports about TLS negotiation failures. It gives domain owners visibility into whether inbound email is being delivered over encrypted connections.
How does this TLS-RPT checker work?
Enter your domain and the checker looks up the TXT record at _smtp._tls.yourdomain.com, validates the v=TLSRPTv1 version tag, and confirms the rua= reporting destination is a valid mailto: or https: URI. It also checks your MX servers for STARTTLS support and any MTA-STS policy.
What does a TLSRPT record look like?
A TLS-RPT record is a DNS TXT record published at _smtp._tls.yourdomain.com with a value such as "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com". The rua= tag tells sending servers where to deliver the aggregate TLS reports.
Do I need MTA-STS to use TLS-RPT?
TLS-RPT works without MTA-STS, but the two are designed to be used together. MTA-STS or DANE enforces encryption, while TLS-RPT provides the feedback loop that tells you whether that enforcement is succeeding across all senders.
Monitor your email encryption
Get automated TLS-RPT processing, continuous monitoring, and complete email security coverage. Free plan covers 1 domain with all protocol checks.