Skip to main content
protocols.pageprotocols.page
TLSA

TLSA Record

Active

The TLSA record (part of DANE – DNS-Based Authentication of Named Entities) pins a TLS certificate or public key to a domain name in DNS.

_port._protocol.name TTL IN TLSA usage selector matching-type certificate-or-hash

In one line

The TLSA record (part of DANE – DNS-Based Authentication of Named Entities) pins a TLS certificate or public key to a domain name in DNS. When DNSSEC is active, TLSA allows clients to verify TLS certificates using DNS instead of relying solely on Certificate Authorities. TLSA is the mechanism for SMTP MTA-STS enforcement and certificate pinning without browser CA trust.

Description

TLSA records are published under a specific owner name encoding: _port._protocol.hostname. For example, a web server on port 443 using TCP would publish at _443._tcp.example.com. The record specifies the certificate usage (CA constraint, service certificate constraint, trust anchor, domain-issued), selector (full cert vs public key), and matching type (full, SHA-256, SHA-512). DANE with TLSA is widely used for securing SMTP between mail servers.

Examples

HTTPS TLSA record
shell
_443._tcp.example.com. IN TLSA 3 1 1 abc123...sha256hash...
SMTP DANE TLSA
shell
_25._tcp.mail.example.com. IN TLSA 3 1 1 sha256hashofcert...
Verify TLSA exists
shell
dig _443._tcp.example.com TLSA +dnssec

Related Record Types

DNSKEYCAA

Specification

RFC 6698 – DNS TLSA record specification →