Agent Wranglers

Hosting and network Optional

Use TLSA records only where checked

Publish TLSA records only for services whose clients check them, such as mail servers. Browsers do not check them.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Publish TLSA records only for services whose clients check them, such as SMTP servers. Skip it for a website. DANE needs DNSSEC, and every key change must publish the new record first.

Example

_25._tcp.mail.example.com.  3600  IN  TLSA  3 1 1 0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6

How to check

A mail test such as internet.nl shows valid DANE for the mail server.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/dane.