TLS-RPT Record Checker
Enter a domain to validate its SMTP TLS Reporting (RFC 8460) record at _smtp._tls.<domain>. TLS-RPT is how you learn when senders fail to negotiate TLS or your MTA-STS/DANE policy — the feedback loop that makes enforcing TLS safe.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Whether a TLS-RPT (v=TLSRPTv1) record exists
- The rua report destinations (mailto: or https:)
- The published record itself
How to read the result
- OK = a record with at least one rua destination — you'll receive TLS failure reports.
- Warn (no rua) = the record exists but has nowhere to send reports.
- Warn (none) = no TLS-RPT; you're blind to senders failing TLS to your MX.
Frequently asked questions
What is TLS-RPT for?
It asks sending providers to send you daily reports about TLS connection successes and failures (including MTA-STS/DANE policy failures) to your MX, so you can catch delivery problems before they bite.
Does TLS-RPT change delivery?
No — it only requests reports. It pairs with MTA-STS and DANE, which are what actually enforce TLS. Deploy TLS-RPT first so you have visibility before you enforce.
What goes in the rua tag?
A destination for aggregate reports — a mailto: address (e.g. mailto:tlsrpt@yourdomain.com) or an https: collector endpoint. You can list more than one.