What is DANE/TLSA?

What is DANE?

DANE stands for «DNS-based Authentication of Named Entities» and is a security protocol that verifies the authenticity of TLS certificates via DNS. It was specifically designed to protect email connections from man-in-the-middle attacks.

What are TLSA records?

TLSA records are DNS entries containing the fingerprint of a TLS certificate. For email security, they are placed under the name _25._tcp.mailserver.domain.ch (Port 25 = SMTP).

A typical TLSA record looks like this:
3 0 1 a1b2c3d4e5f6...

Where:

• 3 = DANE-EE (End-Entity, verifies the server certificate directly)
• 0 = Full Certificate (the entire certificate is checked)
• 1 = SHA-256 Hash (the fingerprint is a SHA-256 hash)

Requirements for DANE

DANE only works in combination with DNSSEC. Without DNSSEC, an attacker could forge the TLSA record itself, rendering DANE useless. Therefore, the chain is:

DNSSEC (signs the DNS zone) → TLSA Record (contains certificate hash) → DANE (verification during email delivery)

Why is DANE important?

Without DANE, an attacker can:

• Downgrade or remove SMTP encryption
• Use a forged certificate
• Read emails undetected

With DANE, encryption is enforced and the certificate is verified — the attacker has no chance.

DANE at FireStorm

At FireStorm, DNSSEC and DANE/TLSA are automatically activated and managed through our system MagicDANE. You don’t have to worry about anything.

Check your DANE status

Open DANE Checker