DANE and TLSA Checker

Check that each server’s TLSA record matches the certificate it actually presents.

Records read locally · servers checked on our server

Servers

Findings

A public lookup.

Pasted text is read in your browser and never leaves it. The domain or host is sent to our server, which asks a validating resolver for the TLSA records and connects to each server to read its certificate (STARTTLS on port 25). Nothing you enter is saved. Google ads may run on this page; we do not send your input to them.

What this tool reads

TLSA records at _port._tcp.host for each mail server (or the host you name), whether DNSSEC protects them (DANE means nothing without it), the certificate chain each server presents, and which certificate or key each record matches. Usage, selector and matching type are explained for each record.

Capabilities and processing

Enter a domain to check its mail servers on port 25, a host:port to check one server, or paste a TLSA record to have it explained. Our server asks a validating resolver for the TLSA records and connects to each server to read its certificate (STARTTLS on port 25).

Each server shows its records, whether DNSSEC protects them, the certificate it presents, and which certificate or key a record matches.

Example workflow

Two of the sample domain’s mail servers match their TLSA records; the backup server renewed its certificate with a new key and still publishes the old record.

Limits and interpretation

Live certificate comparison requires the configured TLS probe. If it is unavailable, records are shown as not compared. Supported ports are 25 and 587 (SMTP STARTTLS), and 443, 465, 853, 993 and 995 (direct TLS). Exact DER, SHA-256 and SHA-512 matching are supported. A matching certificate or key is diagnostic evidence, not a complete independent DANE certification-path validation. TLSA records without DNSSEC are ignored by senders. Browsers do not use DANE for websites. Nothing is stored.

Related tools

All tools · Privacy