TLS-RPT record parser
Reads one TLS-RPT record as the MTA-STS check does (RFC 8460 section 3): v=TLSRPTv1, exactly one rua tag, and whether each report address is a mailto: or https: URI. Nothing is looked up or contacted.
Updated 2026-10-27
What this tool checks
The record is read with the same reader as the MTA-STS and TLS-RPT checks:
- Version: the text must start with
v=TLSRPTv1. - Report addresses: exactly one
ruatag, and every address amailto:orhttps:URI.
How to read the result
A valid record lists its report addresses in order. One pair of surrounding double quotes is removed and noted.
Limitations
- Report addresses are not contacted, so whether a mailbox exists or an https: endpoint accepts reports is not checked.
Use it from code
API reference for TLS-RPT record parser
curl -i -X POST https://api.lookproof.dev/v1/mail/tlsrpt-parse \
-H 'content-type: application/json' \
-d '{"record": "v=TLSRPTv1; rua=mailto:[email protected],https://tlsrpt.example.com/v1"}'A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | TLS-RPT record |
|---|---|
| Deadline | 2 seconds |
| Freshness | Computed from the input; nothing is looked up |
| Price | $0.002 per check |
Findings this tool can report
TLS-RPT (1)
- Warning
TLSRPT_INVALIDThe TLS-RPT record is not valid.
Frequently asked questions
What is TLS-RPT?
SMTP TLS Reporting (RFC 8460) lets sending servers report TLS problems they meet when delivering mail to your domain, for example a policy that does not match. The record at _smtp._tls says where the daily reports go.
What makes a TLS-RPT record invalid?
It must start with v=TLSRPTv1 and have exactly one rua tag. Each address in it, separated by commas, must be a mailto: or https: URI. Senders ignore an invalid record: TLSRPT_INVALID.
Can I check the record a domain publishes?
Yes: the TLS-RPT check looks the record up in DNS with the same reader, and the MTA-STS check reads it together with the MTA-STS policy.