Free email security tool
Enter where SMTP TLS reports should be sent. You get the exact TXT host and value to publish so sending servers can tell you when encrypted delivery to your domain fails.
Create a TXT record in your DNS zone with the host and value shown above. After DNS has updated, read it back with the TLS-RPT Checker.
Each participating sender sends at most one report a day: how many delivery sessions to your domain succeeded with TLS, how many failed, and why (an expired certificate, a host name that does not match, a mail server missing from the MTA-STS policy). The reports contain counts and server names, not message content.
It does not look at your domain, so it does not know whether an MTA-STS policy or DANE records exist. It also cannot confirm that the mailbox you entered accepts mail.
Add your domain to CloudSpex to monitor MTA-STS, TLS-RPT, SPF, DKIM and DMARC continuously and get alerted when a record changes.
Start Monitoring FreeA TXT record at _smtp._tls.yourdomain.com that tells sending mail servers where to send daily reports about TLS failures when delivering mail to your domain. It is defined in RFC 8460.
The record is valid on its own, but senders report on MTA-STS and DANE policy results. Without either policy there is little for them to report, so most domains publish TLS-RPT together with MTA-STS.
An email address is simpler: reports arrive as compressed JSON attachments. An https URL is for a service that accepts report uploads. You can list more than one destination.
No. It only builds a record from what you enter. To read the record your domain publishes today, use the TLS-RPT Checker.