DANE Checker

Check DNSSEC and DANE for mail

DANE pins your mail servers’ TLS certificates in DNSSEC-signed DNS, so senders can authenticate them without trusting any certificate authority.

Guide

What the DANE checker tests

DANE for SMTP (RFC 7672) publishes a fingerprint of each mail server's certificate in a TLSA record. Because the record is protected by DNSSEC, a sender can verify the certificate and refuse a connection an attacker has intercepted.

  • DNSSEC. The checker relies on validating public resolvers: answers carry the AD flag only if the signature chain checks out, and a broken chain comes back as SERVFAIL.
  • TLSA records at _25._tcp.each MX host, validated under DNSSEC. Unsigned TLSA records are ignored by senders.
  • Certificate usage. RFC 7672 recommends 3 1 1 (DANE-EE, public key, SHA-256) or 2 1 1; usages 0 and 1 should not be used for SMTP.
  • Coverage. Every MX host should be protected, or an attacker can push delivery to the one that is not.

Whether the fingerprints match the certificates the servers actually present needs an SMTP connection, which a browser cannot open, so that part is reported as not verifiable.

FAQ

DANE: common questions

What is DANE for email?

DANE (DNS-based Authentication of Named Entities) for SMTP, defined in RFC 7672, lets a domain publish its mail servers’ TLS certificate fingerprints in DNSSEC-signed TLSA records. Sending servers that support DANE require TLS and verify the certificate against those records.

Does DANE require DNSSEC?

Yes. Without DNSSEC an attacker could forge the TLSA records along with everything else, so senders ignore TLSA records that do not validate. Both the domain and the MX hosts’ zones must be signed.

What does "3 1 1" mean in a TLSA record?

Certificate usage 3 (DANE-EE: match the server’s own certificate), selector 1 (match its public key, not the whole certificate), matching type 1 (SHA-256 hash). It is the form RFC 7672 recommends, and it survives certificate renewals that keep the same key.

DANE or MTA-STS?

They solve the same problem with different trust models: DANE relies on DNSSEC, MTA-STS on HTTPS and certificate authorities. Many domains publish both; senders use whichever they support, and DANE takes precedence where both apply.

Guides

Learn more

  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.