Email

DANE / TLSA Checker

TLSA Records

Check DANE Deployment

Enter a domain name to validate its DANE deployment — TLSA records, DNSSEC chain, and live certificate match for every MX host.

Looks up TLSA records at _25._tcp.<mx-host> for every MX of the domain. Port 25 with tcp is the standard for SMTP DANE.

DNS Resolver

Most domains return the same records on every resolver — the choice matters during DNS propagation, or when a filtering resolver blocks a domain.

No domain checked yet

Enter a domain above and click Check DANE to validate its TLSA records.

Tool Features

Complete DANE validation — DNS, DNSSEC, and the live certificate

TLSA Lookup

Queries _port._proto TLSA records for every MX host

DNSSEC Verified

Confirms records are authenticated — required for DANE

Live Cert Match

Fetches the real certificate and matches every hash

Actionable Verdict

Clear deployed / mismatch / missing result per host

Learn more

Guides & explainers related to this tool

Guide

How to Enable DNSSEC

DANE's prerequisite: sign your zone and publish DS records at the registrar.

Article

What Is DNSSEC?

How the DNS chain of trust works and why DANE depends on it.

Article

What Is MTA-STS?

The HTTPS-based alternative to DANE for enforcing SMTP TLS.

Related Tools

Discover similar utilities
Authentication

DANE / TLSA Generator

DNSSEC Validator

MTA-STS & TLS-RPT Checker

MX Lookup