Skip to main content

New

Test your email deliverability

Send a test email and get a complete diagnosis of your SPF, DKIM and DMARC authentication in seconds.

  • Real send test
  • Instant diagnosis
  • No signup required
Run the test

TLS-RPT Syntax Checker

Validate SMTP TLS Reporting records before DNS publication

Check your TLS-RPT record syntax before publishing. Our validator ensures RFC 8460 compliance, validates reporting URIs (mailto and https), and catches common configuration errors instantly.

The TXT record value for _smtp._tls.yourdomain.com

RFC 8460 Compliance

Validates your record against the SMTP TLS Reporting specification. Catches version errors, invalid tags, and malformed syntax.

Reporting URI Validation

Verifies mailto: and https: URIs are properly formatted. Checks email addresses and HTTPS endpoints for correctness.

Instant Feedback

Get real-time validation as you type. No waiting, no form submission required. Results appear immediately.

Detailed Error Messages

Clear explanations for every issue found. Each error includes the specific problem and how to fix it.

MTA-STS Companion

TLS-RPT works with MTA-STS to enforce and report on TLS encryption. Validate both records for complete email security.

What is TLS-RPT and why validate syntax?

TLS-RPT (SMTP TLS Reporting) is defined in RFC 8460 and provides visibility into TLS encryption failures for your email domain. When mail servers fail to establish secure connections with your domain, TLS-RPT ensures you receive detailed reports.

Syntax validation matters because:

  • Invalid records are silently ignored by sending servers
  • You receive no reports if the syntax is wrong
  • Typos in reporting URIs mean lost failure data
  • RFC non-compliance causes unpredictable behavior

TLS-RPT record format explained

Basic structure

v=TLSRPTv1; rua=mailto:tlsrpt@captaindns.com
ComponentRequiredDescription
v=TLSRPTv1YesVersion identifier, must be exactly "TLSRPTv1"
rua=YesReporting URI(s) for aggregate reports

Reporting URI formats

Email (mailto:)

rua=mailto:tlsrpt@captaindns.com

HTTPS webhook

rua=https://tlsrpt.captaindns.com/v1/report

Multiple URIs

rua=mailto:tlsrpt@captaindns.com,https://api.captaindns.com/tlsrpt

Common syntax errors

Missing version tag

# Wrong - missing v=TLSRPTv1
rua=mailto:tlsrpt@captaindns.com

# Correct
v=TLSRPTv1; rua=mailto:tlsrpt@captaindns.com

Invalid version string

# Wrong - incorrect version
v=TLSRPT1; rua=mailto:tlsrpt@captaindns.com

# Correct
v=TLSRPTv1; rua=mailto:tlsrpt@captaindns.com

Malformed URI

# Wrong - missing mailto: scheme
v=TLSRPTv1; rua=tlsrpt@captaindns.com

# Correct
v=TLSRPTv1; rua=mailto:tlsrpt@captaindns.com

Invalid email in mailto URI

# Wrong - invalid email format
v=TLSRPTv1; rua=mailto:tlsrpt@

# Correct
v=TLSRPTv1; rua=mailto:tlsrpt@captaindns.com

Setting up TLS-RPT

Step 1: Choose reporting destination

Decide where to receive reports:

  • Email address: Simple setup, manual review
  • HTTPS endpoint: Automated processing, requires development
  • Third-party service: Managed solution with dashboards

Step 2: Generate the record

Use our TLS-RPT Generator to create a properly formatted record.

Step 3: Validate syntax

Paste the generated record into this validator before publishing. Fix any errors reported.

Step 4: Publish to DNS

Add a TXT record at _smtp._tls.captaindns.com with your validated record value.

Step 5: Verify publication

Use our TLS-RPT Record Checker to confirm the record is live and correctly configured.

TLS-RPT and MTA-STS integration

TLS-RPT is designed to work with MTA-STS (Mail Transfer Agent Strict Transport Security). Together they provide:

ProtocolPurpose
MTA-STSEnforces TLS encryption for incoming mail
TLS-RPTReports on TLS connection failures

Recommended setup:

  1. Deploy MTA-STS with mode: testing first
  2. Configure TLS-RPT to receive failure reports
  3. Monitor reports for issues
  4. Switch MTA-STS to mode: enforce when ready

FAQ - Frequently asked questions

Q: What is a TLS-RPT record?

A: A TLS-RPT (SMTP TLS Reporting) record is a DNS TXT record that tells mail servers where to send reports about TLS connection failures. Defined in RFC 8460, it works alongside MTA-STS to help you monitor email encryption issues. The record specifies one or more reporting URIs that receive daily aggregate reports.

Q: What is the correct TLS-RPT syntax?

A: A valid TLS-RPT record starts with v=TLSRPTv1; followed by rua= and one or more reporting URIs. Example: v=TLSRPTv1; rua=mailto:tlsrpt@captaindns.com. You can specify multiple URIs separated by commas. Each URI must use mailto: or https: scheme.

Q: What errors does this tool detect?

A: The validator catches: missing or incorrect version tag (must be TLSRPTv1), invalid reporting URIs, malformed email addresses in mailto: URIs, missing rua= tag, syntax errors in the record format, and unknown tags that may cause issues.

Q: Can I use multiple reporting addresses?

A: Yes, TLS-RPT supports multiple reporting URIs. Separate them with commas in the rua= tag. Example: v=TLSRPTv1; rua=mailto:reports@captaindns.com,https://tlsrpt.captaindns.com/report. Each URI receives the same aggregate reports.

Q: What's the difference between mailto and https URIs?

A: mailto: URIs send reports as gzip-compressed email attachments. https: URIs POST reports to a webhook endpoint. Email is simpler to set up, while HTTPS allows automated processing. Most organizations start with mailto: and add HTTPS later.

Q: Do I need TLS-RPT if I have MTA-STS?

A: TLS-RPT is strongly recommended with MTA-STS. MTA-STS enforces TLS encryption, while TLS-RPT tells you when enforcement fails. Without TLS-RPT, you won't know if mail servers are failing to connect securely. Both records work together for complete visibility.

Complementary tools

ToolPurpose
TLS-RPT Record CheckerValidate live DNS record configuration
TLS-RPT GeneratorCreate RFC 8460 compliant records
MTA-STS Record CheckerVerify MTA-STS policy deployment
MTA-STS GeneratorCreate MTA-STS policy and DNS records
Email Domain CheckComplete email authentication audit

Useful resources