Free Tool

DANE/TLSA Checker

Check DANE/TLSA records for your mail server. Verify DNS-based authentication for secure, encrypted email delivery.

Free instant check — no signup required

What is DANE?

DNS-based Authentication of Named Entities (DANE) is a security protocol that uses DNSSEC-signed TLSA records to bind TLS certificates to DNS names. For email, DANE allows domain owners to specify exactly which TLS certificate their mail server uses, providing strong protection against man-in-the-middle attacks and compromised certificate authorities.

Traditional TLS relies on certificate authorities (CAs) to vouch for a server's identity, but any CA can issue a certificate for any domain. DANE eliminates this weakness by publishing the expected certificate directly in DNS, secured by the DNSSEC chain of trust. A sending server can verify it is connecting to the authentic mail server without relying on the CA system.

DANE is widely deployed in countries like the Netherlands, Germany, and the Czech Republic, particularly among government and financial institutions. It works alongside MTA-STS and TLS-RPT to provide comprehensive email transport security. Organizations seeking the strongest possible email encryption guarantees should consider deploying DANE alongside these complementary standards.

Frequently Asked Questions

What is DANE for email?
DANE (DNS-based Authentication of Named Entities) is a protocol defined in RFC 6698 that uses DNSSEC to associate TLS certificates with domain names. For email, DANE allows a receiving domain to publish TLSA records in DNS that specify which TLS certificate a sending server should expect when connecting to the domain's mail server, preventing man-in-the-middle attacks.
How does DANE work with DNSSEC?
DANE requires DNSSEC to function. The TLSA record is published in DNS, but without DNSSEC, an attacker could forge the TLSA record to substitute their own certificate. DNSSEC provides a cryptographic chain of trust from the root DNS zone down to your domain's records, ensuring the TLSA record is authentic. This is DANE's key advantage over systems that rely on the certificate authority ecosystem.
What is a TLSA record?
A TLSA record is a DNS record type that associates a TLS certificate with a specific service. For email, TLSA records are published at _25._tcp.mailserver.hostname. The record contains four fields: certificate usage (0-3, specifying how to match the certificate), selector (0=full cert, 1=public key only), matching type (0=exact, 1=SHA-256, 2=SHA-512), and the certificate association data (the actual cert, key, or hash value).
Do I need DNSSEC for DANE?
Yes, DNSSEC is a hard requirement for DANE. Without DNSSEC-signed DNS records, DANE provides no security benefit because an attacker can forge TLSA records. Implementing DNSSEC requires support from your DNS registrar and DNS hosting provider. Many major registrars (Cloudflare, Route 53, GoDaddy) support DNSSEC, but it adds operational complexity. If DNSSEC is not feasible for you, consider MTA-STS as an alternative.
Should I implement DANE if I already have MTA-STS?
DANE and MTA-STS complement each other and you can deploy both. MTA-STS is easier to implement and works without DNSSEC. DANE provides stronger guarantees because it uses DNSSEC-backed certificate pinning rather than HTTPS-hosted policy files. In regions like Europe where DNSSEC and DANE adoption is higher, deploying both provides defense in depth and ensures compatibility with more sending servers.

Need continuous DANE monitoring?

Get automatic alerts when your DANE/TLSA records change or break. Monitor DANE, SPF, DKIM, DMARC, and 60 blacklists.

Start Monitoring Free