Skip to content

TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX. Without it, MTA-STS and DANE failures are silent. This checker reads _smtp._tls and reports whether a well-formed v=TLSRPTv1 record exists and whether a reporting destination is configured.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. A private assessment (see the checkbox in the scan dialog) is the only difference.

1.59%
of mail-enabled Top-1M domains publish TLS-RPT
1.80%
have enforced transport security at all

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
SPF checker

SPF lists which hosts may send mail as your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

What is TLS-RPT?

SMTP TLS Reporting (RFC 8460) is a TXT record at _smtp._tls.example.com. It asks sending MTAs to mail you daily JSON reports about STARTTLS success and failure when they deliver to your MX hosts.

Does a TLS-RPT record encrypt my mail?

No. It is telemetry. MTA-STS and DANE are the controls that resist downgrades. TLS-RPT tells you those controls are failing. A record without a usable rua= destination still produces nothing you can read.

Where is the record published?

TXT at _smtp._tls.example.com, typically v=TLSRPTv1; rua=mailto:tlsrpt@example.com or an https: URI. SecLens.ONE checks presence, syntax, and whether a reporting destination is configured, then still runs the rest of the stack.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.