# TLSA record

A TLSA record pins the certificate or public key a service uses for TLS, so clients can check they're talking to the right server without relying only on certificate authorities. This is DANE. It's most used for email between mail servers, and only works on DNSSEC-signed domains.

- Record type: TLSA
- Type number: 52
- Used for: Certificates and keys
- How common: Specialist
- Defined in: RFC 6698, RFC 7671, RFC 7672

## Format

```
_<port>._<protocol>.<host> <ttl> IN TLSA <usage> <selector> <matching type> <data>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Usage | What is pinned. 3 (DANE-EE) pins the server's own key or certificate; 2 (DANE-TA) pins your own CA; 0 and 1 also require a public CA. | 0 to 3. Mail servers almost always use 3 or 2. |
| Selector | 0 the full certificate, 1 just the public key. | 0 or 1. 1 survives renewals that keep the key. |
| Matching type | 0 the full data, 1 SHA-256, 2 SHA-512. | 0 to 2. 1 is usual. |
| Data | The certificate, key or hash, in hex. | 64 hex characters for SHA-256. |

## Examples

### Mail server, key pinned

```
_25._tcp.mail 3600 IN TLSA 3 1 1 0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6
```

Senders that check DANE will only deliver to mail.example.com over TLS with this key.

## Renewing safely

Before changing a pinned key, publish a second TLSA record for the new key, wait at least two TTLs, switch the server, then remove the old record. With selector 1 (public key) and a renewal that reuses the key, nothing changes at all.

## TTL

3600 or less, so key rollovers don't drag.

## Common mistakes

- Publishing TLSA on a domain without DNSSEC. Clients ignore it.
- Replacing the certificate before publishing the new hash, so DANE-checking senders stop delivering mail.
- Using usage 0 or 1 for SMTP; mail uses 3 or 2.

## At your DNS host

- Cloudflare, Route 53 and Google Cloud DNS support TLSA. The domain must also have DNSSEC turned on, with the DS set at the registrar.

## Questions

### What is DANE?

DNS-based Authentication of Named Entities: publishing TLSA records so clients can verify a server's TLS certificate through DNSSEC instead of, or as well as, certificate authorities.

## Related

- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)
- [DS record](https://lemon.domains/dns-records/ds.md)
- [MTA-STS record](https://lemon.domains/dns-records/mta-sts.md)
- [CAA record](https://lemon.domains/dns-records/caa.md)
- [SSHFP record](https://lemon.domains/dns-records/sshfp.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/tlsa