Skip to main content
WebTools

TLS-RPT checker

Check where other mail servers send reports when they can't make a secure connection to a domain's mail servers.

Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.

What we check

We look up the TLS-RPT record at _smtp._tls.<domain> (RFC 8460). It must start with v=TLSRPTv1 and have a rua= tag listing where reports go:

We check that there is exactly one record and that each destination is written correctly. We don't send anything to the destinations.

Why it matters

Sending mail servers that support MTA-STS or DANE send a daily report of connections to your mail servers that couldn't be secured. Without TLS-RPT, problems such as an expired certificate on a mail server can go unnoticed.

Frequently asked questions

What is TLS-RPT?

SMTP TLS Reporting (RFC 8460). A domain publishes where sending mail servers should send daily reports about connections to its mail servers that couldn't be secured, for example because of a certificate problem or an MTA-STS policy mismatch.

Do I need TLS-RPT with MTA-STS?

It isn't required, but it is strongly recommended. Without reports you won't know when senders refuse to deliver because of your MTA-STS policy.

Can reports go to a web address?

Yes. "rua" can list mailto: email addresses and https: addresses that accept reports by HTTP POST. We only check that the addresses are written correctly; we don't contact them.

Do you store the report addresses?

No. They are public DNS data, shown only in your result. They are kept for a few minutes in the saved result and are never logged or counted.

Related tools

  • MTA-STS Checker

    Check whether a domain asks other mail servers to use secure, verified connections when they deliver its email.

  • MX Lookup

    See which mail servers receive email for a domain, in priority order, with each server's addresses.

  • DMARC Checker

    Find the DMARC policy that applies to a domain, see what each setting means, and spot mistakes that make receivers ignore it.

  • SPF Checker

    Check that a domain's SPF record is valid, stays within the 10-lookup limit, and says what you expect about servers that may send its mail.

  • Website Health Check

    Run the main website, DNS and email checks on one site at once and get a short report, area by area, with links to the full results.