TLS-RPT Checker

About the tls-rpt checker

TLS-RPT (SMTP TLS Reporting, RFC 8460) is a companion mechanism to MTA-STS and DANE. It does not enforce anything by itself; it only asks senders that attempted to deliver mail to your domain to report back, once a day, on whether the TLS negotiation succeeded and, if not, what went wrong. The record is a TXT record at _smtp._tls.yourdomain.com in the form v=TLSRPTv1; rua=mailto:reports@yourdomain.com, naming where the daily aggregate reports should be sent. This tool checks that the record exists, is syntactically valid, and that the rua target is a well-formed mailto: or https: destination. It does not deliver a message or make a request to that destination, so it cannot tell you the mailbox exists or that reports would be accepted there; confirm that separately once reports start arriving.

Reports arrive as JSON, usually gzip-compressed, and describe delivery attempts grouped by policy type (MTA-STS or DANE), result (success or a specific failure reason such as certificate-expired or validation-failure), and the sending and receiving hosts involved, giving visibility that would otherwise be invisible since failed TLS negotiations do not normally generate any signal back to the domain owner. TLS-RPT is most valuable paired with MTA-STS or DANE, since it reports on failures against those specific policies, but it also reports opportunistic STARTTLS failures on their own, which makes it worth publishing even before either of those stricter mechanisms is in place.

Publishing the record is the easy part; actually reviewing what comes back is where the value is, since a growing rate of validation failures in the reports is often the first visible sign that a certificate rotation or a mail server change broke something senders now refuse to deliver through. A steady trickle of unavoidable, low-volume failures is normal background noise across the internet, so the useful signal is a sudden increase in failure rate or a new failure type appearing, not the mere presence of any failure at all.

Common questions

What is TLS-RPT?

SMTP TLS Reporting: senders that attempted delivery to your mail servers send daily aggregate reports about TLS negotiation successes and failures, whether or not you have MTA-STS or DANE.

Where is the record?

A TXT record at _smtp._tls.yourdomain.com in the form v=TLSRPTv1; rua=mailto:reports@yourdomain.com.

Is it useful without MTA-STS?

Partly. It also reports opportunistic STARTTLS and DANE failures on their own, but it is most valuable alongside MTA-STS, which gives it a specific enforced policy to report violations against.

Who actually reads the reports?

Most domains route them into a dashboard or monitoring tool rather than reading raw JSON by hand, since the volume and format are made for machine processing, not manual review.