TLS-RPT Record Checker

Free online tool · DNS-over-HTTPS live lookup · runs in your browser, no data upload

TLS-RPT (SMTP TLS Reporting, RFC 8460) collects TLS transport failure reports after MTA-STS or DANE deployment. Its DNS record lives at _smtp._tls.<domain>, declaring the v=TLSRPTv1 version and the rua= aggregate report address (mailto: URI). Without a TLS-RPT record, domain administrators cannot see how many messages fail TLS transport under MTA-STS/DANE policies — it is the “monitoring dashboard” of your mail security policy.

Enter a domain; the tool queries the _smtp._tls. TXT record (TLS-RPT reporting configuration).

Features

  • Standard location: queries the _smtp._tls.<domain> TXT record, per RFC 8460
  • Report address parsing: extracts the mailto: URI from rua= and shows the report mailbox
  • Version check: confirms the record starts with v=TLSRPTv1 and flags malformed records
  • Companion hint: reminds that TLS-RPT should be deployed with MTA-STS/DANE to close the “policy + monitoring” loop

How to Use

TLS-RPT records live at _smtp._tls. in the format v=TLSRPTv1; rua=mailto:reports@example.com. After you enter a domain and query, the tool parses the version and report address. If “No TLS-RPT record found” is returned, the domain has no TLS failure monitoring — consider deploying it together with MTA-STS or DANE. The rua= address must be a real mailbox that can receive mail, otherwise reports are lost.

Why Check Regularly

TLS-RPT (SMTP TLS Reporting, RFC 8460) provides “observability” for MTA-STS and DANE. It defines a DNS TXT record (_smtp._tls) declaring the mailbox that receives TLS transport reports.

Without TLS-RPT, you cannot tell whether MTA-STS is effective or whether legitimate mail is being rejected. TLS-RPT reports aggregate: TLS connection success/failure counts, failure reasons (certificate, policy, protocol errors), and the remote domains involved — first-hand data for troubleshooting interoperability.

When checking TLS-RPT, confirm the rua address is valid and well-formed (multiple addresses allowed, comma-separated), and deploy it with MTA-STS — MTA-STS defines policy, TLS-RPT provides feedback, together forming a deploy-monitor-optimize loop.

Interpreting Results

CheckPass CriteriaRisk
Record exists_smtp._tls.<domain> TXT record existsHigh (no record = no reports)
Version tagStarts with v=TLSRPTv1High
rua addressAt least one valid mailbox that can receive reportsHigh
Address formatrua=mailto:xxx@domain well-formed; multiple addresses comma-separatedMedium

Common Misconfigurations & Fixes

  • Missing record：Add a TXT record: v=TLSRPTv1; rua=mailto:report@yourdomain.com
  • Invalid rua mailbox：Ensure the report mailbox receives mail; a dedicated address makes statistics easier
  • Not paired with MTA-STS：Deploy MTA-STS + TLS-RPT together and let report data drive policy changes
  • Format error：Strictly follow RFC 8460: v=TLSRPTv1; rua=mailto:... (space after semicolon optional but keep it consistent)

Technical Standards

This tool follows the IETF standards below; lookup and parsing logic match the RFC definitions:

  • DNS lookup: RFC 8484 (DNS Queries over HTTPS), RFC 1035 (DNS protocol)
  • Record parsing: TLS-RPT: RFC 8460 §3 (DNS record), §4 (report format)