Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

TLS-RPT record check

Checks whether TLS failures reaching your mail servers are reported to anyone, the feedback you need before enforcing MTA-STS.

Judged against RFC 8460 section 3

Free, instant, no signup. This test reads your live DNS the way a receiving server does.

Symptoms

Silence. Mail that fails on TLS is retried and eventually returned to the sender, and the sender is the one who sees it. You find out when a customer mentions that their reply bounced. Without TLS-RPT there is no channel through which that reaches you.

Diagnosis

TLS-RPT is a single TXT record at _smtp._tls.yourdomain.com containing a version and a destination. Receiving providers batch up what happened when they connected to your servers and send you a daily summary.

The version string is v=TLSRPTv1 and it is case-sensitive. The destination is either a mailto: address or an https: endpoint. Anything else is discarded, and because nothing depends on this record working, nothing tells you.

Cure

  1. Publish v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.com at _smtp._tls.
  2. Point it at a mailbox someone actually reads, or a service that parses the JSON for you.
  3. Watch it for two weeks before moving MTA-STS from testing to enforce.

Questions people actually ask

What does TLS-RPT actually report?

Daily summaries from receiving providers about TLS connections to your mail servers: how many succeeded, how many failed, and why. It is the only external view you get of encryption problems in transit.

Do I need TLS-RPT if I have MTA-STS?

You need it more. MTA-STS in enforce mode makes senders refuse to deliver when TLS fails, TLS-RPT is how you find out that is happening, ideally before you turn enforcement on.

Where should the reports go?

A mailbox someone reads, or a reporting service. They arrive as JSON attachments, so a shared alias that nobody opens is the same as not having them.

Does TLS-RPT slow anything down or leak information?

No. It adds one DNS record and asks receivers to send you a daily summary. It contains aggregate connection data about your own servers.

Related tests

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.