Free domain tool
Read the _smtp._tls DNS record and see where SMTP TLS delivery reports are sent — and whether anything can actually reach those destinations.
TLS-RPT does not require or improve encryption. It asks sending servers to report what happened when they delivered to you, which is how a failing TLS setup becomes visible instead of silent. The enforcement job belongs to MTA-STS; TLS-RPT is how you see whether that enforcement is working.
For the combined view of every email signal, use the Email Security Check. To focus on a DMARC policy, use the DMARC Checker. To focus on SPF, use the SPF Record Checker.
TLS-RPT (SMTP TLS Reporting, RFC 8460) lets a domain publish an address where sending mail servers send daily reports about TLS delivery to it. It is how you find out that TLS negotiation is failing, instead of the failures happening silently.
No, and this is the most common misunderstanding. TLS-RPT does not require, enforce or improve encryption. It only asks senders to tell you what happened. The enforcement job belongs to MTA-STS or DANE; TLS-RPT is how you see whether that enforcement is working.
Not by itself. A domain without TLS-RPT is not more vulnerable to attack — it is only blind to TLS delivery problems. This checker scores its absence as a small, measured gap rather than a failure.
A domain with no record knows it has no reporting. A domain with a record that cannot be parsed believes reports are arriving when nothing is being sent, so TLS delivery problems stay invisible while the configuration looks correct.
RFC 8460 defines two: a mailto: address and an https: endpoint that accepts report uploads. You can list more than one, separated by commas. A destination using any other scheme is published but no sender can deliver to it.
In a TXT record at _smtp._tls under your domain, for example _smtp._tls.example.com, in the form v=TLSRPTv1; rua=mailto:tls-reports@example.com.
No. This checker reads the DNS record that says where reports should go. It does not receive, parse or store TLS reports, and it does not send email.
It means the DNS lookup did not complete, so nothing can be said about the domain and no score is produced. That is different from a lookup that succeeded and found no record, which is a measured result and does count.