DNS Security

DANE for HTTPS

DANE for HTTPS publishes certificate associations in DNS at _443._tcp.<hostname>. A DANE-aware client can use TLSA records protected by DNSSEC to authenticate a TLS service. Mainstream browsers generally do not validate DANE, so it does not replace normal HTTPS certificate management.

Author
CategoryDNS Security
Length2 minute read
UpdatedOctober 17, 2026

What Domain Visualizer checks

Domain Visualizer queries TLSA at _443._tcp.example.com for the scanned domain. “HTTPS DANE TLSA record present” means the returned tuples passed basic syntax checks. It does not prove that the live server certificate matches, that DNSSEC validates, or that a browser will enforce the record.

“HTTPS DANE TLSA record appears malformed” means at least one returned record failed those checks. Inspect every record at the affected name, including records left behind during a certificate rotation.

Read a TLSA record

A TLSA tuple contains certificate usage (0–3), selector (0–1), matching type (0–2), and hexadecimal association data. Selector 0 uses the certificate; selector 1 uses its public key. Matching type 0 uses the selected data directly, 1 uses SHA-256, and 2 uses SHA-512.

dig +dnssec _443._tcp.example.com TLSA

For example, a 3 1 1 tuple associates the service's public key using a SHA-256 digest, which must contain exactly 64 hexadecimal characters. SHA-512 requires 128. Generate the association from the certificate or key actually served; do not copy another domain's digest.

Troubleshoot and deploy safely

  1. Check the owner name, port, and protocol. Records for HTTPS on port 443 belong under _443._tcp followed by the actual service hostname.
  2. Correct invalid field values, missing data, non-hexadecimal characters, and digest lengths at your DNS provider.
  3. Validate the DNSSEC chain from the parent DS to the signed zone. The DNSSEC flag requested by dig +dnssec alone does not validate that chain. See Debugging DNSSEC Validation Errors.
  4. Compare the association with the certificate or public key served on every endpoint. Domain Visualizer's presence check does not make this comparison.
  5. Plan overlapping TLSA records during key rotation and allow cached records to expire before retiring the previous key. Recheck after the change.

Continue to serve a valid publicly trusted HTTPS certificate for ordinary browsers. Only clients with DANE support and successful DNSSEC validation can rely on TLSA policy.

HTTPS and SMTP use different service names

HTTPS TLSA records use the web hostname on port 443. SMTP DANE records normally use each MX hostname on port 25. Publishing one does not configure the other. See DANE for Email for mail transport guidance.