Check your domain's TLS-RPT record
Check the SMTP TLS Reporting record for any domain and see where TLS failure reports are sent.
Check MTA-STS tooTLS-RPT (SMTP TLS Reporting, RFC 8460) asks mail servers that deliver to your domain to send you a daily report of TLS connection failures. It is a TXT record at _smtp._tls.yourdomain with an address to send reports to.
This checker reads that record and shows the rua address. Use TLS-RPT together with MTA-STS: the reports tell you if a policy change would block real mail.
How to read the result
- Found: the record exists and lists where reports go (rua=mailto: or an https URL).
- Not found: no record at _smtp._tls. You will not hear about TLS failures on incoming mail.
- Reports arrive as JSON files, often gzip-compressed, usually once a day from Google, Microsoft and other large senders.
What the reports show
Each report lists the sending organization, the number of successful TLS sessions, and any failures with a reason, such as an expired or mismatched certificate, a failed STARTTLS, or an MX host that does not match your MTA-STS policy. A sudden rise in failures after a certificate renewal or an MX change is the main thing to watch for.
Example
A TLS-RPT record
_smtp._tls.example.com TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"
Use a mailbox or group that can receive many small automated messages.
Common problems and fixes
Frequently asked questions
Do I need TLS-RPT without MTA-STS?
It still works and shows STARTTLS problems, but it is most useful with MTA-STS, where a failure means mail was not delivered.
Who sends TLS-RPT reports?
Large senders such as Google and Microsoft. Small mail servers usually do not send them.
Can TLS-RPT reports go to the same address as DMARC reports?
Yes, but keep them apart if you parse them with a tool. They have different formats: TLS-RPT is JSON, DMARC is XML.
Does TLS-RPT change how mail is delivered?
No. It only asks senders to report. Delivery does not change.