What is a TLS-RPT record?
Reviewed by Prabath Thalangama · Last updated
A TLS-RPT record asks sending mail servers to report problems they hit when making encrypted connections to your domain, such as failed STARTTLS or certificate errors. It is a TXT record at _smtp._tls.yourdomain with a rua address. This checker looks the record up and shows its reporting address.
Reports arrive daily as JSON from senders such as Google and Microsoft. They are how you find out that MTA-STS or DANE is blocking delivery, or that one of your MX hosts has an expired certificate, before users notice.
TLS-RPT changes nothing about delivery on its own; it only asks for reports.
How do I check TLS-RPT?
- Enter the domain that receives mail.
- Confirm the record exists and its rua points at a mailbox or HTTPS endpoint you actually monitor.
How to read the results
- Record
- The v=TLSRPTv1 TXT record at _smtp._tls.yourdomain.
- rua
- Where reports go: mailto: addresses or https: endpoints, separated by commas.
- Findings
- A missing record is reported as information; it isn't required, but it is recommended alongside MTA-STS.
Common TLS-RPT problems
No reports ever arrive
Check the record name (_smtp._tls, not _tls-rpt) and that the mailbox accepts gzip attachments. Only senders that support TLS-RPT send reports.
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:[email protected]"Examples and command-line equivalents
Look up the record
dig +short TXT _smtp._tls.example.comFrequently asked questions
Do I need TLS-RPT without MTA-STS?
It still shows senders' TLS failures to your MX hosts, which is useful. It matters most with MTA-STS or DANE, where a TLS failure means mail isn't delivered.
What format are TLS reports?
JSON, usually gzip-compressed and attached to an email. Reporting services can collect and chart them for you.
Further reading
- RFC 8460: SMTP TLS Reporting
- Run a full Super Scan to check DNS, email, website and TLS for a domain at once.