DANE / TLSA Checker

Validate TLSA records against live mail server certificates

Check DANE Deployment

Enter a domain name to validate its DANE deployment — TLSA records, DNSSEC chain, and live certificate match for every MX host.

Looks up TLSA records at _25._tcp.<mx-host> for every MX of the domain. Port 25 with tcp is the standard for SMTP DANE.

DNS Resolver (MX lookup):

TLSA records are always resolved through a DNSSEC-validating resolver so the authentication (AD) flag is trustworthy.
No domain checked yet

Enter a domain above and click Check DANE to validate its TLSA records.

Tool Features

Complete DANE validation — DNS, DNSSEC, and the live certificate

TLSA Lookup

Queries _port._proto TLSA records for every MX host

DNSSEC Verified

Confirms records are authenticated — required for DANE

Live Cert Match

Fetches the real certificate and matches every hash

Actionable Verdict

Clear deployed / mismatch / missing result per host

Learn more

Guides & explainers related to this tool

Guide

How to Enable DNSSEC

DANE's prerequisite: sign your zone and publish DS records at the registrar.

Article

What Is DNSSEC?

How the DNS chain of trust works and why DANE depends on it.

Article

What Is MTA-STS?

The HTTPS-based alternative to DANE for enforcing SMTP TLS.

Related Tools
Discover similar utilities
Authentication

DANE / TLSA Generator

DNSSEC Validator

MTA-STS & TLS-RPT Checker

MX Lookup