TLSA record
A TLSA record pins the certificate or public key a service uses for TLS, so clients can check they're talking to the right server without relying only on certificate authorities. This is DANE. It's most used for email between mail servers, and only works on DNSSEC-signed domains.
| Record type | TLSA |
|---|---|
| Type number | 52 |
| Used for | Certificates and keys |
| How common | Specialist |
| Defined in | RFC 6698, RFC 7671, RFC 7672 |
Format
_<port>._<protocol>.<host> <ttl> IN TLSA <usage> <selector> <matching type> <data>
| Field | What it means | Accepted values |
|---|---|---|
| Usage | What is pinned. 3 (DANE-EE) pins the server's own key or certificate; 2 (DANE-TA) pins your own CA; 0 and 1 also require a public CA. | 0 to 3. Mail servers almost always use 3 or 2. |
| Selector | 0 the full certificate, 1 just the public key. | 0 or 1. 1 survives renewals that keep the key. |
| Matching type | 0 the full data, 1 SHA-256, 2 SHA-512. | 0 to 2. 1 is usual. |
| Data | The certificate, key or hash, in hex. | 64 hex characters for SHA-256. |
Check a TLSA record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid TLSA record.
| Part | What it means |
|---|---|
| Name_25._tcp.mail | A service name. Underscore names hold records for a protocol (such as _dmarc or _sip._tcp), not a website. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeTLSA | DANE: TLS certificate pin. |
| Usage3 | 3 (DANE-EE): this exact server key or certificate, no CA needed. The usual choice for mail servers. |
| Selector1 | 1: just the public key (SPKI). Survives certificate renewals that keep the key. |
| Matching type1 | 1: a SHA-256 hash, the usual choice. |
| Data0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6 | The certificate or key data, or its hash, in hex. |
Examples
Mail server, key pinned
_25._tcp.mail 3600 IN TLSA 3 1 1 0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6
Senders that check DANE will only deliver to mail.example.com over TLS with this key.
Renewing safely
Before changing a pinned key, publish a second TLSA record for the new key, wait at least two TTLs, switch the server, then remove the old record. With selector 1 (public key) and a renewal that reuses the key, nothing changes at all.
See it on a real domain
TTL
3600 or less, so key rollovers don't drag. How TTL works
Common mistakes
- Publishing TLSA on a domain without DNSSEC. Clients ignore it.
- Replacing the certificate before publishing the new hash, so DANE-checking senders stop delivering mail.
- Using usage 0 or 1 for SMTP; mail uses 3 or 2.
At your DNS host
- Cloudflare, Route 53 and Google Cloud DNS support TLSA. The domain must also have DNSSEC turned on, with the DS set at the registrar.
Questions
What is DANE?
DNS-based Authentication of Named Entities: publishing TLSA records so clients can verify a server's TLS certificate through DNSSEC instead of, or as well as, certificate authorities.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free