TLSA record
The DNS record used by DANE that ties a TLS certificate or public key to a service, published at a name such as _25._tcp.mx.example.com.
What it means
A TLSA record has three numbers and the association data. Certificate usage: 0 and 1 rely on public certificate authorities, 2 (DANE-TA) names a trust anchor, 3 (DANE-EE) pins the server's own certificate or key. Selector: 0 for the full certificate, 1 for the public key only. Matching type: 0 for the exact data, 1 for a SHA-256 hash, 2 for SHA-512.
RFC 7671 recommends 3 1 1 (the SHA-256 hash of the server's public key) for most sites, because the record need not change when a certificate is renewed with the same key. RFC 7672 says port-25 TLSA records should not use usages 0 or 1.
The record only counts when the zone is DNSSEC-signed. Update it before changing keys, or senders that validate DANE will refuse delivery.
Example
_25._tcp.mx1.example.com. IN TLSA 3 1 1 8cb0fc6c527506a053f4f14c8464bebbd6dede1738d11468dd953d7d6a3021f1Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 6698: The DNS-Based Authentication of Named Entities (DANE) TLS Protocol: TLSA, section 2.1rfc-editor.org
- RFC 7671: The DANE Protocol: Updates and Operational Guidance, section 5.1rfc-editor.org
- RFC 7672: SMTP Security via Opportunistic DANE TLS, section 3.1.3rfc-editor.org
- Microsoft Learn: How SMTP DANE workslearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes