A TLSA record is the DNS record that carries DANE data (RFC 6698). It binds a TLS certificate or public key to a specific hostname and port, so a connecting server can confirm it is talking to the genuine endpoint.
The record lives at a special name combining port and protocol, for example _25._tcp.mail.example.com for SMTP. Each record has four fields: usage (often 3, meaning the certificate is matched directly), selector (whether the full certificate or just its public key is matched), matching type (usually a SHA-256 hash), and the certificate association data itself, which is the hash or raw bytes being matched.
For email, a sending server performing STARTTLS compares the certificate offered by your MX host against the TLSA record. A mismatch means delivery is refused, preventing a downgrade or interception attack. Because the protection depends on the DNS answer being authentic, TLSA records are only trusted on DNSSEC-signed zones.
The main operational risk is certificate rotation: if you renew a certificate but forget to update the TLSA hash, inbound mail breaks. A common pattern is publishing records for both the current and the next certificate during a changeover. Check your TLSA records match the live certificate on every MX host.
Check it on your domain
- DANE Record Checker: looks up TLSA records for DANE on a mail host.
- DNS Record Checker: looks up any DNS record type for a host.