Free tool / TLS reports
Is mail to you actually encrypted?
Drop the TLS reports Google and Microsoft send to your TLS-RPT address. See how much mail arrived over verified TLS, which server failed and why — and whether MTA-STS can be enforced.
Drop TLS report files here
.json, .json.gz or .zip, as they arrive by email — up to 60 at once.
Read in your browser. Nothing is uploaded.
Questions people ask
What are TLS-RPT reports?
With a TXT record at _smtp._tls.<your domain> (v=TLSRPTv1; rua=mailto:…), senders such as Google and Microsoft email you a daily JSON report (RFC 8460): how many delivery sessions to your mail servers used encrypted, verified TLS, and the reason for each failure. They usually arrive as .json.gz attachments.
When is it safe to switch MTA-STS from testing to enforce?
When a week or two of reports in testing mode show no failures. In testing mode, senders still deliver when TLS fails; in enforce mode, every one of those failures becomes a message they refuse to deliver.
What does certificate-host-mismatch mean?
The mail server’s TLS certificate doesn’t name the MX host the sender connected to — common on backup MX servers and after a migration. Install a certificate that covers that host name, or point the MX at a name the certificate covers.
Is it safe to drop my reports here?
Nothing is uploaded: files are decompressed and read in your browser. TLS reports contain sending and receiving server addresses and session counts, not message content or recipients.