Report

Help us improve this tool

TLS RPT Record Builder

Compose SMTP TLS Reporting (TLS-RPT) TXT records with ruas endpoints for mail security monitoring.

O M T

Publish SMTP TLS-RPT DNS records

TLS-RPT (RFC 8460) lets receiving mail servers report TLS negotiation failures to domain owners. Publish a TXT record at _smtp._tls.example.com with v=TLSRPT1 and one or more rua= reporting URIs (typically mailto: or HTTPS endpoints). This builder formats the record and shows the correct DNS host name.

Deployment checklist

  1. Create a mailbox or HTTPS endpoint that accepts aggregate TLS failure reports.
  2. Publish the generated TXT at _smtp._tls on your mail domain.
  3. Monitor reports alongside DMARC aggregate data for downgrade or certificate issues.

Also see DMARC Record Builder and SPF Generator for related email authentication DNS records.

Frequently Asked Questions

What is the difference between TLS-RPT and MTA-STS?

MTA-STS publishes an HTTPS policy that instructs senders to use TLS with valid certificates. TLS-RPT provides feedback when TLS delivery fails. They complement each other but use different DNS names and formats.

Can I list multiple rua endpoints?

Yes. Separate URIs with commas in the builder; they are joined in the single rua= tag per RFC 8460.

Is the optional max_age tag included?

You may set max_age in seconds when your reporting provider requires it. Leave the field blank to omit the tag.