Free TLSA Record Lookup & Checker
| Domain | Type | Primary NS | Responsible Person | Serial | Refresh | Retry | Expire | Minimum | TTL |
|---|
| Name Server | IP Address | TTL |
|---|
| Domain | Type | TTL | Record Value |
|---|
| Trace Result |
|---|
| Domain | Type | Record | Status |
|---|
| Domain | Type | Record | Status |
|---|
Check live TLSA DNS records, TTL values, and trace the full root-to-authoritative resolution path.
TLSA (DANE) Records Overview
What is a TLSA record?
A TLSA record is part of DANE. It binds a TLS certificate or public key to a specific name, port, and protocol (e.g. _443._tcp.example.com), letting clients verify the certificate through DNSSEC.
Why do you need a TLSA record?
TLSA/DANE lets you pin which certificate is valid for a service, reducing reliance on the public CA system and protecting against mis-issued certificates - it is widely used to secure SMTP (mail) over TLS.
TLSA record structure
A TLSA record uses a _port._protocol.domain name and stores usage, selector, matching type, and the certificate-association data. Example: _443._tcp.example.com. 3600 IN TLSA 3 1 1 0c72ac70b745...
How to create a TLSA record?
Generate the TLSA data from your server certificate or key, then publish a TLSA record at the _port._protocol.domain name. DNSSEC must be enabled for DANE to be trusted.
FAQs
TLSA Record Troubleshooting & Common Fixes
Inbound mail delivery failures: “DANE validation failed” on port 25
Strict security mail services (like ProtonMail, German public institutions, and enterprise mail relays) enforce DANE over TLS for SMTP. When you renew your mail server's SSL/TLS certificate, if the TLSA record at _25._tcp.mail.yourdomain.com still serves the fingerprint of the expired certificate, connecting MTAs immediately abort email delivery to prevent potential man-in-the-middle attacks.
TLSA records completely ignored: “DANE insecure / DNSSEC missing”
RFC 6698 strictly dictates that TLSA records are only valid if protected by an unbroken DNSSEC chain of trust. If your domain does not have active DNSSEC configured with a valid DS record at your parent registrar, validating clients are required by specification to disregard the TLSA record entirely.
Subtle certificate renewals breaking Usage 3 Selector 0 configurations
A TLSA parameter of Usage 3 (DANE-EE) with Selector 0 pins the full DER-encoded certificate. If your SSL provider (such as Let's Encrypt or ZeroSSL) issues a renewed certificate with an updated serial number or signature timestamp, the hash changes completely even if your private key remains unchanged.
3 1 1) for automated TLS certificates. Selector 1 pins only the SubjectPublicKeyInfo (public key). As long as your server software re-uses the same private key during automated renewals (e.g. Certbot with --reuse-key), your published TLSA record remains permanently valid without emergency manual updates.
