TLSRPT Look Up
Related tools
What this is
TLSRPT (published at _smtp._tls.yourdomain.com) tells sending servers where to deliver daily aggregate reports about TLS failures they encountered when sending you mail. It is the visibility companion to MTA-STS.
How to read your result
A valid record has v=TLSRPTv1 and a rua= destination (mailto: or https:). Without MTA-STS it still works — you simply learn about TLS problems you cannot yet enforce against.
Common problems and how to fix them
No TLSRPT while running MTA-STS
How it shows up: If enforce mode ever blocks legitimate mail, you find out from angry senders instead of from reports.
How to fix it: Publish "v=TLSRPTv1; rua=mailto:[email protected]" before tightening MTA-STS, and review the reports during the testing phase.
Report destination rejects the reports
How it shows up: The mailbox bounces the (sometimes large) gzipped JSON attachments, or a filter eats them.
How to fix it: Use a dedicated address or an https: endpoint; whitelist the reports and confirm size limits accommodate them.
Related reading
- MTA-STS: Forcing Encrypted SMTP, and How to Check It Is Actually OnMTA-STS turns opportunistic SMTP encryption into an enforced policy. Here is how the DNS record and policy file work, and how to verify both are live.
- Email Health Check: One Lookup for MX, SPF, DMARC, and TLSRun one domain lookup to see whether your MX, SPF, DMARC, MTA-STS, and TLS-RPT records are configured correctly and where your email is exposed.
Frequently asked questions
- What is a TLSRPT record?
- A TLSRPT record is a DNS TXT entry published at _smtp._tls.<yourdomain> that turns on SMTP TLS Reporting (RFC 8460). It tells other mail servers where to send daily aggregate reports about whether they could connect to your servers over encrypted TLS.
- How do I use this tool?
- Enter a domain and the tool queries the TXT record at _smtp._tls.<domain> server-side, then shows whether a valid TLSRPT record exists. It parses the value and highlights the reporting destinations so you can confirm your setup at a glance.
- Why does a TLSRPT record matter?
- It gives you visibility into TLS delivery problems that you would otherwise never see, such as failed encryption or certificate errors when other servers try to reach you. Paired with MTA-STS or DANE, it helps you catch and fix issues that could expose email to interception or block delivery.
- How do I read the result?
- A valid record starts with v=TLSRPTv1 and includes a rua= tag listing where reports go, for example rua=mailto:[email protected] or an https: endpoint. If the tool finds no record, no reporting is configured; if the rua target is wrong, reports will be lost.
- What is a common gotcha with TLSRPT?
- TLSRPT only requests reports, it does not itself enforce or require TLS, so you still need MTA-STS or DANE for actual protection. Also make sure the record lives at the _smtp._tls subdomain and not at your root domain, or servers will not find it.