TLS-RPT record checker: validate your SMTP TLS reporting record
A TLS-RPT record is a DNS TXT record at _smtp._tls.yourdomain.com that tells other mail servers where to send daily reports about TLS failures when they deliver mail to you. It looks like v=TLSRPTv1; rua=mailto:reports@yourdomain.com. Enter a domain to check the record's syntax and whether each report address can receive mail.
Reads _smtp._tls from public DNS and checks each report destination with DNS only; no report is sent. 10 checks a minute.
Sample result
acme.example's TLS report record is valid; reports go to tls-reports@acme.example.
- TLS-RPT record
- _smtp._tls.acme.example
- Reports to
- tls-reports@acme.example
- MTA-STS
- Published
What this means for you
You'll hear when other servers can't deliver mail to you over an encrypted connection.
- Reads the _smtp._tls TXT record
- Flags duplicates and malformed fields
- Checks each mailto: or https: destination
- Suggests a record when none is valid
- TLS-RPT
- MTA-STS
- TXT
By SimpleVerifier Team · Last updated
How do I check a TLS-RPT record?
- Enter the domain that receives mail, such as yourdomain.com. An address or the full _smtp._tls name works too.
- Read the result: one valid v=TLSRPTv1 record, a rua= tag, and any syntax problems such as wrong case or a second record.
- Check Where reports go: each mailto: domain needs MX records, and each https: host has to resolve to a public address.
- If there's no valid record, copy the suggested one, change the address to a mailbox or report service you use, and publish it as a TXT record.
Example
- You enter
- The domain
acme.example. - You get
- Valid:
_smtp._tls.acme.examplepublishesv=TLSRPTv1; rua=mailto:tls-reports@acme.example, and acme.example has MX records, so reports can be delivered. An MTA-STS record is also published. - Limits
- One domain per check and 10 checks a minute per connection.
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting, RFC 8460) lets a domain ask sending mail servers for daily reports on how TLS went when they delivered mail to it: how many sessions succeeded, and which failed and why, such as an expired certificate or a host name mismatch. Senders that support it email or POST a JSON report to the address in the record.
It doesn't change how mail is delivered. It's the monitoring half of MTA-STS and DANE: those tell senders to require TLS, and TLS-RPT tells you when that's failing. Google's MTA-STS guide suggests running a policy in testing mode for two weeks and using the daily reports to fix problems before enforcing.
What does a TLS-RPT record look like?
It is one TXT record at _smtp._tls.yourdomain.com: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com. For an HTTPS endpoint, rua=https://reports.example.com/v1/tlsrpt. Several destinations go in one rua=, separated by commas.
The syntax is stricter than it looks. RFC 8460 defines v=TLSRPTv1 and rua= as case-sensitive, so v=tlsrptv1 is discarded. If more than one record starting with v=TLSRPTv1; exists, senders must assume you have no TLS-RPT policy at all. Commas, semicolons and exclamation marks inside a URI must be percent-encoded.
How do I set up TLS-RPT?
Pick where reports should go, then publish the TXT record. A dedicated mailbox such as tls-reports@yourdomain.com works; reports arrive as gzipped JSON attachments, so many teams send them to a DMARC or TLS reporting service instead, which gives you an rua= address of theirs to use.
Add a TXT record with host _smtp._tls and the value from the checker, wait for DNS to update, and run the check again. Report emails must carry a valid DKIM signature from the reporting domain, which RFC 8460 requires senders to add, so a report service can tell genuine reports from forged ones.
What's the difference between MTA-STS and TLS-RPT?
MTA-STS is the policy: it tells senders to deliver to your MX hosts only over valid TLS. TLS-RPT is the reporting channel: it tells you what happened. You can publish TLS-RPT without MTA-STS, but then reports can only describe sessions under the no-policy-found policy type, so most domains set up both, starting MTA-STS in testing mode.
Microsoft's MTA-STS guide likewise points to TLS-RPT reports for spotting delivery issues. Check the policy side with the MTA-STS checker.
How is this different from a TXT lookup?
| TLS-RPT checker | TXT record lookup | |
|---|---|---|
| Reads _smtp._tls | Yes | Yes |
| Case-sensitive v= and rua= check | Yes | No |
| Duplicate record rule | Flags it | Shows both |
| Each report destination checked | MX or DNS per destination | No |
| Suggested record | When missing or invalid | No |
Who uses this tool, and for what?
- IT admins
- Confirm the TLS-RPT record is valid before switching MTA-STS from testing to enforce, so you'd hear about failures.
- Email security teams
- Audit client domains for duplicate or wrong-case records that make senders ignore TLS-RPT entirely.
- MSPs and agencies
- Check that a report service's rua= address resolves after moving a client's DNS.
- Developers
- Verify an https:// report endpoint's host name resolves publicly before pointing production domains at it.
What can’t this tool tell you?
- It checks DNS only. It can't see whether reports are being sent or read, or confirm that a mailbox exists at the rua= address.
- For https: destinations it checks the host resolves; it doesn't POST to the endpoint.
- It doesn't check DANE TLSA records; use the MTA-STS checker for the policy side.
- Which sending servers send reports is up to them. A valid record doesn't guarantee reports from every sender.
Common questions
- What is TLS-RPT?
- SMTP TLS Reporting, defined in RFC 8460: a DNS record that asks sending mail servers to report TLS connection results and failures for mail they deliver to your domain, usually once a day.
- What is a TLS-RPT record?
- A TXT record at _smtp._tls.yourdomain.com with v=TLSRPTv1 and an rua= address or URL where reports should be sent.
- How do I set up TLS-RPT?
- Publish a TXT record at _smtp._tls.yourdomain.com with the value v=TLSRPTv1; rua=mailto:an-address-you-read, then check it here. Pair it with an MTA-STS policy in testing mode.
- What is MTA-STS and TLS-RPT?
- MTA-STS tells senders to use valid TLS when delivering to your domain; TLS-RPT asks them to report when TLS fails. Together they enforce encryption in transit and show you when it breaks.
- Why is my TLS-RPT record not found?
- It's usually at the wrong name, such as _smtp.yourdomain.com or a DNS host that appended the domain twice. It must be a TXT record at exactly _smtp._tls.yourdomain.com.
- Does Office 365 need TLS-RPT?
- It isn't required, but it's how you learn about TLS failures on mail sent to your Microsoft 365 domain. Publish it in your DNS like any other TXT record; the record doesn't depend on your mail host.
- Is TLS-RPT free?
- Yes. It's a DNS record and an open standard. Sending reports to your own mailbox costs nothing; report-reading services may charge.
Sources
Authentication and capacity are half of deliverability.
The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.