Advanced DANE Record Checker

DNS-Based Authentication of Named Entities (DANE) relies on the TLSA resource record to securely bind a TLS server certificate to a domain name. Unlike strictly relying on Certificate Authorities (CAs), DANE uses DNSSEC to authenticate the certificate, preventing Man-in-the-Middle (MitM) attacks even if a CA is compromised.

It is defined in RFC 6698 .

These numbers represent the Usage, Selector, and Matching Type fields of the TLSA record:

• Usage 3 (DANE-EE): Domain-issued certificate (most common for self-signing or bypassing CA trust).
• Selector 1 (SPKI): Matches only the public key (allows certificate renewal without changing DNS if key stays same).
• Matching Type 1 (SHA-256): Checks the SHA-256 hash of the selected data.

So, _443._tcp.example.com. IN TLSA 3 1 1 [hash] tells the client to trust the server's public key if it matches the SHA-256 hash provided.

This error means our tool queried the DNS for _port._protocol.domain (e.g., _443._tcp.example.com) but received no answer.

Common fixes:

• Ensure you published the record at the correct subdomain (prefix with _port._protocol).
• Check if your DNS propagation is complete.
• Verify that your DNS host supports TLSA records (some basic registrars do not).

Yes, absolutely. DANE relies on the chain of trust established by DNSSEC. Without DNSSEC signing on your zone, clients cannot trust the TLSA record, as it could have been spoofed by a simple DNS poisoning attack. If your domain is not DNSSEC-signed, DANE validation will fail or be ignored by clients.

This isn't a direct DANE error, but often appears when testing mail servers. However, in the context of DANE:

If you see validation failures, it means the certificate presented by the server does not match the hash in your TLSA record. This happens often when you renew your certificate (e.g., via Let's Encrypt) but forget to update the DNS record.Tip: Use Selector 1 (SPKI) and keep your private key constant during renewal to avoid this.

Yes! In fact, it's a great combination. To make managing it easier:

• Use Usage 3 (DANE-EE) + Selector 1 (SPKI).
• Configure your ACME client (like Certbot) to reuse the account private key or the certificate private key (CSR reuse) so the hash doesn't change on every renewal.
• Alternatively, use automation tools that update your DNS automatically when the certificate renews.

Both secure SMTP email transmission, but they work differently:

• DANE uses DNSSEC to authenticate the certificate directly. It is harder to set up but more secure against CAs.
• MTA-STS uses a text file hosted on HTTPS and a TXT record to enforce TLS. It relies on the Web PKI (trusted CAs) and is often easier for large organizations to deploy without DNSSEC.

Many experts recommend implementing both for maximum compatibility and security.

You can use OpenSSL to generate the SHA-256 hash for your TLSA record. For a certificate file server.crt with Usage 3, Selector 1, Matching 1:

Or simply use our Advanced DANE Record Checker tool after setting it up to verify your live hash!