Free Tool

TLS-RPT Checker

Check your domain's TLS-RPT record configuration. Verify you're receiving reports about TLS failures in email delivery.

Free instant check — no signup required

What is TLS-RPT?

SMTP TLS Reporting (TLS-RPT) is a standard defined in RFC 8460 that provides a reporting mechanism for domains to receive feedback about TLS connection successes and failures when other mail servers deliver email to them. It is the companion reporting standard to MTA-STS and DANE.

Without TLS-RPT, domain owners have no visibility into whether email being delivered to their domain is encrypted in transit. If a sending server fails to establish a TLS connection due to certificate errors, misconfiguration, or an active attack, the domain owner would never know. TLS-RPT provides this critical feedback loop.

TLS-RPT reports are delivered as JSON files to an email address or HTTPS endpoint specified in your DNS TXT record. They include details about which sending servers experienced TLS failures, the type of failure, and the volume of affected sessions, enabling you to quickly diagnose and fix encryption issues.

Frequently Asked Questions

What is SMTP TLS Reporting (TLS-RPT)?
TLS-RPT (SMTP TLS Reporting, defined in RFC 8460) is a standard that allows domains to receive reports about TLS connection failures when other mail servers attempt to deliver email to them. It works similarly to DMARC reporting but focuses specifically on TLS encryption issues during email transport rather than email authentication.
How do I set up TLS-RPT?
To set up TLS-RPT, add a DNS TXT record at _smtp._tls.yourdomain.com with the value "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com" (replacing the email address with where you want to receive reports). You can also use an HTTPS endpoint instead of email by specifying "rua=https://your-endpoint.com/report" for automated processing.
What does a TLS-RPT report contain?
TLS-RPT reports are JSON-formatted and contain information about the reporting organization, the date range, the receiving domain's MTA-STS or DANE policy, the total number of successful and failed TLS sessions, and details about any failures including the failure type (certificate errors, MTA-STS policy failures, DANE validation errors, etc.) and the sending MTA's IP address.
What's the difference between TLS-RPT and DMARC reports?
DMARC reports (both aggregate and forensic) focus on email authentication — SPF, DKIM, and DMARC policy outcomes. TLS-RPT reports focus on transport security — whether TLS encryption was successfully negotiated between mail servers. DMARC reports help you track sender authentication failures; TLS-RPT reports help you track encryption failures. Both use similar DNS-based reporting infrastructure but serve different security purposes.
How do I read TLS failure reports?
TLS-RPT reports arrive as gzip-compressed JSON files. Each report contains a 'policies' array where each entry describes a policy (MTA-STS or DANE) and its success/failure counts. Failures are categorized by type: 'starttls-not-supported' means the server didn't offer STARTTLS, 'certificate-expired' means the TLS cert is expired, 'validation-failure' means certificate verification failed, and 'sts-policy-fetch-error' means the MTA-STS policy file couldn't be retrieved.

Need continuous TLS monitoring?

Get automatic alerts when your TLS-RPT configuration changes or breaks. Monitor TLS-RPT, MTA-STS, SPF, DKIM, DMARC, and 60 blacklists.

Start Monitoring Free