[ Free tool · Email Authentication ]

DANE / TLSA Checker

Check DNSSEC-signed TLSA records that lock down SMTP TLS.

[ About this tool ]

This DANE checker looks up the TLSA record at _25._tcp for each of your MX hosts, confirms it is DNSSEC-signed and flags usage and matching types that are risky for SMTP (RFC 7672).

How to read the results

  • ›TLSA records only count when DNSSEC validates them.
  • ›3 1 1 (DANE-EE, public key, SHA-256) is the most common and robust choice.
  • ›Publish the next key's TLSA before rotating certificates.

Frequently asked questions

What is DANE for email?

DANE uses DNSSEC-signed TLSA records to tell sending servers which certificate your mail server uses, so connections cannot be downgraded or intercepted.

DANE or MTA-STS?

Both protect SMTP TLS. DANE needs DNSSEC; MTA-STS needs an HTTPS policy file. Many organisations deploy both.

Learn more in our guide: What is MTA-STS? Setup Guide, Record and Policy File

[ Get this fixed for me ]

Free expert review of your result

Our team reviews this result and sends you the exact fixes, at no cost.

[ More tools ]

MTA-STS & TLS-RPT Checker

Check your TLS policy record, policy file and TLS reporting.

Full Domain Health Scan

Run every email security check at once and get one score.

DMARC Checker

Look up and explain any domain's live DMARC record.

SPF Checker

Validate your SPF record and check the 10-lookup limit.

DKIM Lookup

Verify a DKIM selector is published and the key is valid.

BIMI Record Checker

Check a BIMI record and whether the logo will actually display.