DNS & Glossary

TLSA record (DANE)

The record behind DANE: it pins which TLS certificate or key is valid for a service using DNSSEC, so a mis-issued certificate from any CA can be rejected.

What it stores

A TLSA record (DNS-Based Authentication of Named Entities, DANE) publishes a hash of the certificate or public key expected on a TLS service, named like _443._tcp.example.com. Because it relies on DNSSEC, a validated TLSA lets clients reject certificates that do not match — independent of the CA system.

Why it matters

  • It provides certificate pinning rooted in DNSSEC, notably strengthening SMTP (MTA-STS/DANE) email security.
  • It reduces reliance on the trust-everyone CA model.

Common mistakes

  • Deploying TLSA without DNSSEC, which makes it unauthenticated and ignored.
  • Failing to update the TLSA hash during certificate renewal, breaking connections.

How WebInspect checks this

  • The Network Inspector reports DNSSEC status and TLS certificate details relevant to DANE.