TLS-RPT check
Looks up the TXT record at _smtp._tls for the domain and checks it as RFC 8460 describes: one record starting with v=TLSRPTv1 and exactly one rua tag with mailto: or https: addresses. The report addresses are not contacted.
Updated 2026-10-27
What this tool checks
The TXT record at _smtp._tls is looked up through public resolvers and read with the same reader as the MTA-STS check:
- Presence: a record starting with
v=TLSRPTv1, orTLSRPT_NOT_FOUND. - One record: more than one TLS-RPT record makes senders ignore them all.
- Report addresses: exactly one
ruatag with mailto: or https: URIs, orTLSRPT_INVALID.
How to read the result
The result shows the record and its report addresses in order.
Limitations
- Report addresses are not contacted: whether a mailbox or endpoint accepts reports is not checked.
Use it from code
API reference for TLS-RPT check
curl -i "https://api.lookproof.dev/v1/mail/tlsrpt?domain=example.com"A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | Domain |
|---|---|
| Deadline | 10 seconds |
| Freshness | Up to 5 minutes, never longer than the record TTL |
| Price | $0.01 per check |
Findings this tool can report
TLS-RPT (2)
- Warning
TLSRPT_INVALIDThe TLS-RPT record is not valid. - Info
TLSRPT_NOT_FOUNDThe domain publishes no TLS-RPT record.
Check (1)
- Warning
CHECK_QUERY_BUDGET_EXCEEDEDThe check stopped after reaching its DNS query limit.
DNS (2)
- Warning
DNS_RESOLVER_FAILUREThe DNS resolver returned a server failure. - Warning
DNS_RESOLVER_TIMEOUTThe DNS resolver did not answer in time.
Frequently asked questions
Why publish a TLS-RPT record?
Sending servers then report TLS problems they meet when delivering to your domain, such as an expired certificate or an MTA-STS mismatch. Without it you learn about such failures only when mail is missing.
Where is the record?
In a TXT record at _smtp._tls under the domain, for example _smtp._tls.example.com, starting with v=TLSRPTv1 and with one rua tag listing mailto: or https: addresses.
How is this different from the MTA-STS check?
The MTA-STS check reads the same record together with the MTA-STS policy. This check only reads TLS-RPT, and the TLS-RPT record parser reads a record you paste.