---
title: "Use TLSA records only where checked · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network/dane
updated: 2026-10-20
licence: "All rights reserved"
---

# Use TLSA records only where checked

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Rule: Publish TLSA records only for services whose clients check them, such as mail servers. Browsers do not check them.
- How: Publish TLSA records only for services whose clients check them, such as SMTP servers. Skip it for a website. DANE needs DNSSEC, and every key change must publish the new record first.
- Check: A mail test such as internet.nl shows valid DANE for the mail server.

Example:

```dns
_25._tcp.mail.example.com.  3600  IN  TLSA  3 1 1 0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/dane`.

- Previous: [Host where routes are signed](https://agentwranglers.se/playbook/website/hosting-and-network/rpki)
- Next: [Be reachable over IPv6](https://agentwranglers.se/playbook/website/hosting-and-network/ipv6)
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)