HTTPfy

TLSA record

A TLSA record pins the TLS certificate or public key a service must present, protected by DNSSEC. This is DANE (DNS-based Authentication of Named Entities).

type code 52 RFC 6698RFC 7671RFC 7672

Live TLSA records from real domains

Checked at via public DNS
_25._tcp.mail.ietf.orgTLSA
_25._tcp.mail.ietf.org. 300 IN TLSA 3 1 1 38a88126a15ae8e643ce9447c3ce9a874ea0e05255d07ee12227809edbe5c7f1
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx01.posteo.deTLSA
_25._tcp.mx01.posteo.de. 900 IN TLSA 3 1 1 0becb1af349fc7c52d47bd380303bfab79ec3d7f32a808843d43ff67270cc419
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx01.posteo.de. 900 IN TLSA 3 1 1 13815b2c03f7bd63c54869706428442edab706d5b018a27575ca989129a196d5
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx01.posteo.de. 900 IN TLSA 3 1 1 2a2413f46c23290866a3fb9c1658a404bcf6a71373d002a29d67c23ed8df298d
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx01.posteo.de. 900 IN TLSA 3 1 1 2ad38769dc6a92ed98fb7a45514c0a74919ebc9fa13514c5c742c92080a66874
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx01.posteo.de. 900 IN TLSA 3 1 1 a73a9adb16bd5a4131df79c446438e138da78fbb64d4ebad97017a4fad4ec92e
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx01.posteo.de. 900 IN TLSA 3 1 1 b2305f6446e9cfae4f00f0acc02533eb057c4f2198b6db068e954d32c1b33eee
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx1.freebsd.orgTLSA
_25._tcp.mx1.freebsd.org. 3600 IN TLSA 3 1 1 0a7e2f469913ea64ca98af1f31bbbcaf51920d8df90d2972a9dc02bf7c37f404
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
_25._tcp.mx1.mailbox.orgTLSA
_25._tcp.mx1.mailbox.org. 3600 IN TLSA 3 1 1 996ad31d65e03f038b8ec950f6f26611529da03e3a283e4400cba2edd04b8a88
  ; DANE-EE (this exact key), public key (SPKI), SHA-256
DNSSEC Inspector for ietf.org (TLSA needs DNSSEC) → SSL Certificate Checker →

What the TLSA record does

The owner name combines port, transport and host: _25._tcp.mx1.example.com for SMTP on mx1. A client that finds a DNSSEC-validated TLSA record compares the server's certificate against it and refuses the connection if nothing matches. Browsers never adopted DANE, but it is widely deployed for server-to-server SMTP: Postfix, Exim and large providers such as Microsoft 365 validate it.

Most deployments use 3 1 1: DANE-EE (match the server's own key, ignore CA validation and expiry), SubjectPublicKeyInfo, SHA-256. Pinning the public key rather than the whole certificate means routine renewals that keep the same key need no DNS change.

Zone-file syntax

_25._tcp.mx1.example.com.  3600  IN  TLSA  3 1 1 0a7e2f469913ea64ca98af1f31bbbcaf51920d8df90d2972a9dc02bf7c37f404
; usage selector matching-type data

Wire format: RDATA is three octets (usage, selector, matching type) and the association data.

Fields

FieldMeaning
Usage0 PKIX-TA (CA, plus normal validation), 1 PKIX-EE, 2 DANE-TA (your own trust anchor), 3 DANE-EE (this exact key). For SMTP use 2 or 3 (RFC 7672).
Selector0 full certificate, 1 SubjectPublicKeyInfo (public key only).
Matching type0 exact bytes, 1 SHA-256, 2 SHA-512.
DataHex of the certificate, key or hash.

Common mistakes

  • Rotating the key (for example letting certbot generate a new one) without publishing the new TLSA first. DANE senders stop delivering.
  • Publishing TLSA in an unsigned zone; it is ignored without DNSSEC.
  • Using usage 0 or 1 for SMTP, which RFC 7672 says senders should not rely on.

Specification

  • RFC 6698: The DNS-Based Authentication of Named Entities (DANE) TLSA Protocol
  • RFC 7671: The DANE Protocol: Updates and Operational Guidance
  • RFC 7672: SMTP Security via Opportunistic DANE TLS

Related record types

  • MTA-STS: enforce TLS for incoming mail
  • CAA: which certificate authorities may issue
  • DNSKEY: the public keys that sign a zone
  • MX: where email for a domain is delivered

All DNS record types