Is Your TLS-RPT Record Actually Reporting?
Type a domain — the checker reads its live _smtp._tls TXT record over DNS, parses the v=TLSRPTv1 tags, checks your rua report destination, and tells you whether an MTA-STS policy is paired. Runs entirely in your browser. No signup.
TLS-RPT reports only flow when MTA-STS is deployed — without a policy, almost no sender generates a report. No record at all? The MTA-STS generator builds the companion record.
Check your TLS-RPT record
Enter a domain below. The checker reads the live TXT record at _smtp._tls + your domain over encrypted DNS and tells you whether it parses as a valid TLS-RPT record with a working report destination.
No record published at all? Build one free — the TLS-RPT Record Generator. Record broken or missing? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.
What the checker looks for
- A TXT record at
_smtp._tls+ your domain (for example_smtp._tls.example.com) — not at the domain root. - The
v=TLSRPTv1version tag — a record that doesn't start with it is ignored by senders. - The
rua=report destination — must be amailto:address orhttps:endpoint; without it, reports have nowhere to go. - The MTA-STS pairing — reported as a note: the checker also reads
_mta-sts+ your domain, because TLS-RPT reports only flow when an MTA-STS policy is enforced.
No record found?
Build one in seconds with the Free MTA-STS Record Generator — it adds the _smtp._tls companion record when you give it a report address. Publish the TXT record at _smtp._tls + your domain and re-run this checker after DNS propagates.
TLS-RPT is the reporting half of the transport-security pair — it only earns its keep once the MTA-STS policy is published and enforcing. Run the Free Email Domain Trust Checker to see where your domain stands on the full authentication set.
Verify the rest of the set
TLS-RPT is the reporting leg. Generate or verify the rest of the authentication set, free, in your browser:
- Free SPF Record Generator
- Free SPF Record Checker
- Free DKIM Record Generator
- Free DKIM Record Checker
- Free DMARC Record Generator
- Free DMARC Record Checker
- Free BIMI Record Generator
- Free BIMI Record Checker
- Free MTA-STS Record Generator
- Free MX Record Checker
- Free Email Domain Trust Checker
- Free Email Header Analyzer
Prefer done-for-you?
If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.
Frequently asked questions
What does the TLS-RPT checker look up? The checker queries the live TXT record at _smtp._tls.yourdomain over DNS (via encrypted DNS-over-HTTPS), then parses the v=TLSRPTv1 record it finds. It reports whether the record exists, whether the version tag is correct, whether the rua= report destination is a valid mailto: address or https: endpoint, and whether an MTA-STS policy is published at _mta-sts.yourdomain.
What does the rua tag do? The rua= tag is the report destination: it tells senders where to deliver TLS failure reports. Without a rua= tag, senders have nowhere to send reports, so the record collects nothing even though it parses as valid. The checker flags a missing or malformed rua= as a failure.
Why does the checker mention MTA-STS pairing? TLS-RPT is the reporting half of MTA-STS. Senders only generate TLS failure reports when they are enforcing an MTA-STS policy for your domain — the policy is published as a TXT record at _mta-sts.yourdomain. Without that policy, this record will collect almost no reports, so the checker reports the pairing as a note.
I have MTA-STS but no TLS-RPT record — does it matter? Your policy still enforces, but you are flying blind: TLS-RPT is what tells you about inbound TLS failures while you run MTA-STS in testing mode — and what gives you the clean-report green light to flip to enforce. Without it you cannot tell a quiet week from a broken one.
No record found — what do I do? Publish one: use the free MTA-STS record generator to build a v=TLSRPTv1 TXT record with your report address, publish it as a TXT record at _smtp._tls.yourdomain, and re-run the checker after DNS propagates (minutes to hours).
Keep Exploring
Use the Workflow Library to browse more guides, comparisons, and integration examples to continue your evaluation.
See the solutions, comparisons, and integration guides collected in one place.
Review grounded audit, compare, fix-plan, and report excerpts before you wire the API into anything.
Jump from the workflow page into the quickstart, endpoint guides, and full OpenAPI reference.