DANE / TLSA
DANE (DNS-based Authentication of Named Entities) with TLSA allows anchoring a server's TLS certificate directly in DNS, signed by DNSSEC. T…
Analyse my site for freeUnderstanding "DANE / TLSA"
DANE (DNS-based Authentication of Named Entities) via TLSA records is an advanced mechanism that anchors a service's TLS certificate information directly in DNS, secured by DNSSEC. Instead of relying solely on the classic hierarchy of certificate authorities (CAs), a client can verify via DNS that the certificate presented by a server exactly matches the one expected by the domain owner.
This check specifically targets port 443 (HTTPS), even though DANE/TLSA is historically more widely used and standardised for securing SMTP connections between mail servers (port 25) than for the web. It's an advanced, optional security mechanism for a typical website — its deployment complexity far exceeds its current real-world adoption.
How TheSiteFuse checks "DANE / TLSA"
TheSiteFuse queries the TLSA record at _443._tcp.<domain>. If a record is found, its content is displayed and the check passes. If absent, the result is marked "info" — this check is purely informational, as DANE/TLSA remains an optional advanced mechanism for the vast majority of websites.
Why "DANE / TLSA" matters
- Not a common security risk — the vast majority of websites operate securely without DANE/TLSA, relying solely on the classic certificate authority system.
- Additional theoretical protection — DANE/TLSA protects against a specific scenario: a compromised or fraudulent certificate authority issuing a valid but unauthorised certificate for your domain. It's defence in depth for very high-security use cases.
- Demanding prerequisite — DANE/TLSA requires DNSSEC to be properly configured and maintained on the domain; a DNSSEC misconfiguration can make the domain entirely unreachable for clients strictly validating DANE, a real operational risk to weigh against the benefit.
Fix "DANE / TLSA" step by step
Who this recommendation is for: organisations with high security requirements (financial institutions, critical infrastructure) and a technical team capable of reliably maintaining DNSSEC. For a standard website, this is generally not a priority.
Prerequisite
DNSSEC must be enabled and functional on the domain (see the dedicated check) — DANE/TLSA without DNSSEC provides no security guarantee, as the TLSA record itself could be forged.
Generating the record
# Generates a TLSA record from the current certificate openssl x509 -in certificate.pem -pubkey -noout | \ openssl pkey -pubin -outform DER | \ openssl dgst -sha256 -binary | xxd -p -c 256
Name: _443._tcp.yourdomain.com Type: TLSA Value: 3 1 1 <hash generated above>
Warning: the TLSA record must be updated on every SSL certificate renewal, or it will block access to the site for clients validating DANE.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — DANE / TLSADoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.