Glossary
SECURITY

TLSA Record

TLSA — a DANE record that publishes a hash of the expected TLS certificate directly in DNS, letting clients verify certs without depending only on public CAs.

TLSA (RFC 6698) is the DNS record type that carries DANE (DNS-Based Authentication of Named Entities) data. It publishes a hash or full copy of the expected TLS certificate for a service, letting clients pin certs at DNS level.

Record Format

_443._tcp.example.com.  TLSA  3 1 1  A1B2C3D4E5F6...

Fields

  • Cert Usage — which cert to match (0=CA constraint, 1=service cert constraint, 2=trust anchor assertion, 3=domain-issued self-signed OK)
  • Selector — full cert (0) or just the SubjectPublicKeyInfo (1)
  • Matching Type — no hash (0), SHA-256 (1), SHA-512 (2)
  • Certificate Association Data — the actual hash

Prerequisites

TLSA requires DNSSEC on the zone. Without a validated chain of trust, an attacker can spoof TLSA and defeat the whole thing.

Real-World Use

  • SMTP DANE — receivers use TLSA on _25._tcp.mx.example.com to authenticate the MX’s cert without depending on public CAs
  • Sparse browser adoption — TLSA never gained traction in browsers (Chrome killed its DANE support)
  • Widespread SMTP adoption in Postfix, Exim, Sendmail

Check the DNSSEC glossary entry, read what an SSL certificate is, and check the SSL/TLS glossary entry.

← All terms Learning hub →