TLS-RPT record

TLS-RPT Checker

Check whether your domain publishes a TLS-RPT record, which asks other servers to send you reports when they fail to deliver to you over TLS.

One record is only part of it

MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC and BIMI all decide together whether your mail is trusted. The full report reads every one of them and hands you the fix.

Run the full domain check

About these results

This tool reads your domain's public _smtp._tls TXT record at the moment of the check. Results reflect current public DNS and can be affected by caching and propagation (up to 24-48 hours). Guidance is general and not a substitute for your provider's official instructions. We don't store the domains you check.

Reference

How TLS-RPT works

What the record is for, how to read the result, and what to do about each problem.

What is TLS-RPT?

TLS-RPT asks other mail servers to send you reports whenever they can't deliver to your domain over a secure TLS connection - the monitoring half that pairs with MTA-STS's enforcement.

How to set it up

Publish a TXT record at _smtp._tls.yourdomain: v=TLSRPTv1; rua=mailto:you@yourdomain.

Why it matters

Without TLS-RPT you have no visibility into silent TLS delivery failures. With it, you learn when senders can't reach you securely so you can fix it early.

Questions

Frequently asked

What is TLS-RPT?

TLS-RPT (SMTP TLS Reporting) is a DNS record that asks sending servers to email you reports when they have trouble delivering to you over TLS. It pairs with MTA-STS.

How do I set up TLS-RPT?

Publish a TXT record at _smtp._tls.yourdomain with v=TLSRPTv1; rua=mailto:you@yourdomain. Reports start arriving from providers that support it.

Related checks