Best free TLS-RPT checkers

AdminKit is built by Netbase JSC. AdminKit is listed below; MxToolbox, EasyDMARC and Hardenize are independent and not affiliated with AdminKit.

What each tool’s own page confirms

MxToolbox’s TLSRPT Lookup, read 2026-11-07, states: “The free SMTP TLSRPT Policy check will check if a domain has enabled SMTP TLS Reporting — a way for email servers to share secure-delivery success and error reports.” No account or pricing is stated as required to run it.

EasyDMARC’s TLS-RPT Record Checker, read 2026-11-07, is listed under EasyDMARC’s free tools and lets you “learn if you have the TLS-RPT TXT record published in your DNS,” validating “the record syntax” against the policy specification and explaining “how to fix your domain’s TLS-RPT record in case it’s invalid.” EasyDMARC also runs a separate TLS-RPT Record Generator for building a new record, a tool AdminKit’s checker does not offer.

Hardenize’s public report, read 2026-11-07, checks TLS-RPT as one section — “SMTP TLS Reporting” — inside a much larger free, no-sign-in domain-security report covering DNS, DNSSEC, CAA, TLS certificates, STARTTLS, SPF, DMARC, DANE and web security headers on the same page. For its own domain, that section reads back the actual configured destination (“mailto:[email protected]”) and concludes “Good. Your TLS-RPT policy is valid.” — a similar depth of result to AdminKit’s, just bundled with everything else rather than a single-purpose tool.

AdminKit’s TLS-RPT check looks up the _smtp._tls.<domain> TXT record defined in RFC 8460 and reads back the rua destination it declares, distinguishing three outcomes on its own tool page: not published (no record), published, but no ‘rua’ destination (a record exists but can’t deliver reports), and a working published record with a destination. Neither MxToolbox’s nor EasyDMARC’s own pages state that same three-way distinction — their own wording describes checking whether a record exists and is syntactically valid, which is a related but narrower claim.

Do MxToolbox’s and EasyDMARC’s free tools show the actual rua destination they found?

Their own pages don’t say either way. MxToolbox’s and EasyDMARC’s own pages don’t state whether their result screen displays the specific rua address or URL it parsed out of the record — only that they check for the record’s existence and validity. This page marks that row unverified (dash) for both rather than assuming either way, the same honesty convention used throughout AdminKit’s other roundups.

The honest angle

If you want a single TLS-RPT check bundled with a full DNS/TLS/web/email security report, Hardenize’s own report covers the most ground in one page, and it’s one of the only tools checked here whose own report demonstrably reads back the actual destination address. If you want to both check an existing record and generate a new one on the same site, EasyDMARC offers both as separate free tools. If you just need a quick existence/validity read inside a wider mail-diagnostic toolset, MxToolbox’s lookup does that. AdminKit’s TLS-RPT check is a dedicated, free, no-account check that reads back the destination and separates the no-destination case from the no-record case explicitly on its own result — a check TLS-RPT is usually deployed alongside MTA-STS, so see the best free MTA-STS checkers roundup for the matching policy record.

TLS-RPT is part of AdminKit’s email authentication cluster, alongside MTA-STS, SPF, DKIM, DMARC and BIMI — see the TLS-RPT glossary entry for what the record itself does.

---

Trademarks belong to their respective owners; AdminKit is not affiliated with MxToolbox, Inc., EasyDMARC, or Hardenize.