TLS-RPT Checker
Whether failed TLS mail delivery attempts are reported.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: RFC 8460 — SMTP TLS Reporting (TLS-RPT)
About this validation
Checks whether failed TLS mail delivery attempts are reported.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live DNS TXT-record lookup performed by SEOTechTests for a _smtp._tls record. Standard: RFC 8460 defines the TLS-RPT record format and reporting mechanism.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What does TLS-RPT do?
It's a DNS record telling other mail servers where to send reports about failed attempts to deliver mail to this domain over encrypted TLS, giving the domain operator visibility into delivery/encryption problems (including potential downgrade attacks).
Why check for TLS-RPT alongside MTA-STS?
MTA-STS enforces TLS-only delivery, but without TLS-RPT the domain operator has no automated visibility into failures that MTA-STS is causing or that a downgrade attempt is happening -- they're complementary, not the same thing.
Does missing TLS-RPT mean mail delivery is insecure?
No. It only means the domain isn't collecting reports about TLS delivery failures -- it doesn't affect whether TLS is actually used, which MTA-STS and the receiving server's own configuration determine.
Why is this a low-impact, informational-leaning check?
TLS-RPT is purely observational (reporting), not enforcement, so its absence is a smaller gap than, say, a missing DMARC policy that leaves spoofed mail unhandled.