Free DANE/TLSA Record Checker & Validator

DANE (DNS-based Authentication of Named Entities, RFC 6698) is a protocol that uses DNS TLSA records secured by DNSSEC to authenticate TLS certificates. For email, DANE provides cryptographic proof that the mail server's TLS certificate is legitimate, preventing man-in-the-middle attacks and eliminating reliance on public certificate authorities.

A TLSA record is a DNS record type that associates a TLS certificate or public key with a specific service on a domain. For SMTP email on port 25, the TLSA record is published at _25._tcp.mailserver.example.com. It contains fields specifying certificate usage, selector, matching type, and the certificate association data (hash).

Yes, DANE absolutely requires DNSSEC. Since DANE relies on DNS to deliver certificate information, DNSSEC is essential to prevent DNS spoofing attacks that could substitute fraudulent TLSA records. Without DNSSEC, DANE provides no security benefit and sending servers will ignore TLSA records.

TLSA defines four usage types: 0 (CA constraint) pins to a specific CA, 1 (service certificate constraint) pins to the server's exact certificate, 2 (trust anchor assertion) specifies a non-public CA, and 3 (domain-issued certificate) pins directly to the certificate or public key. Usage type 3 is most common for email DANE.

DANE protects email by publishing TLSA records that sending servers verify against the TLS certificate presented during the SMTP connection. This prevents: downgrade attacks (stripping STARTTLS), man-in-the-middle attacks (substituting fraudulent certificates), and reliance on potentially compromised CAs. It provides end-to-end transport security verification.

First, enable DNSSEC on your domain. Then generate TLSA records for your mail server certificates and publish them at _25._tcp.{mx-hostname}. Most commonly, use certificate usage 3, selector 1 (public key), and matching type 1 (SHA-256). Rotate TLSA records before certificate renewal to avoid validation failures.