Bulk TLS-RPT checker: does each domain collect SMTP TLS reports?
In short: Paste domains and see each one's _smtp._tls TXT record checked against RFC 8460, with every report destination tested and a note on whether the domain also publishes MTA-STS. Limit: Only DNS is checked. It can't tell whether reports arrive or anyone reads them.
A bulk TLS-RPT checker reads the SMTP TLS reporting record of many domains in one run. Paste up to 100 domains, or 500 after a free Google sign-in, and each row shows the _smtp._tls record checked against RFC 8460, whether each report destination can receive reports, and whether the domain also has MTA-STS. DNS only. Download the results as CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
acme.example has a valid TLS-RPT record; globex.example's report address is at a domain with no mail server.
- Domain
- acme.example
- Record
- v=TLSRPTv1
- Destination
- mailto, has MX
What this means for you
A record whose reports can't be delivered tells you nothing; fix the destination.
- RFC 8460 syntax checked
- Each destination tested
- MTA-STS pairing noted
- No report sent; CSV out
- TLS-RPT
- RFC 8460
- SMTP
By SimpleVerifier Team · Last updated
Auditing the email DNS of a domain list?
- Paste the domains here: up to 100 a run, or 500 after a free Google sign-in. Filter to the missing or broken records and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check the TLS-RPT record of many domains?
- Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.
- Press Check TLS-RPT records. Each domain's TXT record at _smtp._tls.<domain> is read over DNS, then each report destination is checked, 10 domains a request. No report is sent and no endpoint is called.
- Read each row: Valid, Has issues (the first problem is shown), No record, or Lookup failed, with the record and every destination's result.
- Filter to domains that need a record or a fix, and download the CSV.
Example
- You enter
- Three domains:
acme.example(a v=TLSRPTv1 record with a mailto: address),globex.example(a record whose mailto: domain has no MX) andinitech.example(no record). - You get
- acme.example: Valid. globex.example: Has issues, naming the destination that can't receive reports. initech.example: No record. Each row shows the record and every destination's result. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 domains a request; DNS only, no report is sent.
What is a TLS-RPT record?
TLS reporting (TLS-RPT) lets a domain ask sending mail servers to report problems they had negotiating TLS when delivering to it. RFC 8460 defines it: the domain publishes a TXT record at _smtp._tls.<domain> that starts v=TLSRPTv1; and names where reports go with rua=, as a mailto: address or an https: endpoint.
It is most useful next to MTA-STS, which says a domain's mail must be delivered over TLS; the reports show where that fails. This tool notes whether each domain also publishes an MTA-STS record.
What does the check test?
That exactly one record starts with v=TLSRPTv1; (the version and rua= tags are case-sensitive), that its syntax is valid, and that each destination can receive reports: a mailto: address's domain must have an MX record, and an https: host must resolve to a public address. Plain http: destinations are not allowed by the RFC and are flagged.
All of it is DNS. The tool never sends a report and never calls a reporting endpoint, so it can't tell you whether anyone reads the reports.
Does every domain need a TLS-RPT record?
No. It is optional, and a domain that doesn't receive mail has little use for it. It matters most for domains that publish MTA-STS or that you want to know about if a sender can't use TLS to reach them. A No record row isn't an error in itself; read it next to the domain's MX and MTA-STS columns in the CSV.
To check the MTA-STS policy itself across a list, use the bulk MTA-STS checker, and for one domain's record in full detail, the TLS-RPT checker.
Who uses this tool, and for what?
- Email administrators
- Find which of your domains publish MTA-STS but no TLS-RPT record to report failures.
- Security teams
- Audit a vendor or subsidiary list for transport-security reporting.
- Deliverability consultants
- Add a TLS-RPT column to a domain audit and export it as CSV.
- MSPs
- Check every client domain after a mail migration.
What can’t this tool tell you?
- Only DNS is checked. It can't tell whether reports arrive or anyone reads them.
- A valid record doesn't mean the domain's mail servers support TLS; that is what the reports are for.
- Public DNS can serve a cached answer for up to the record's TTL.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check TLS-RPT for many domains?
- Paste them into a bulk TLS-RPT checker like this one. It reads each domain's _smtp._tls TXT record and tests it against RFC 8460, with a CSV of the results.
- Is this bulk TLS-RPT checker free?
- Yes. It is a free tool: up to 100 domains a run with no account, and up to 500 a run when you sign in with Google, with no card.
- Does it send a TLS report?
- No. It reads DNS and checks that report destinations could receive mail or resolve. No report is sent and no endpoint is called.
- Why does a valid-looking record show an issue?
- Usually a destination: a mailto address at a domain with no MX record, or an https host that doesn't resolve. The row shows the first problem and every destination's result.
- Is TLS-RPT the same as MTA-STS?
- No. MTA-STS sets a policy that mail must use TLS. TLS-RPT asks senders to report TLS failures. They are published separately and work well together.
- Does a domain need TLS-RPT to receive email?
- No. It is optional reporting. Mail is delivered with or without it.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.