I need to setup TLSA records in the DNS for my host. I want to use it for HTTPS, e-mail and SSH.

  • What are TLSA records?
  • What does TLSA records look like?
  • How do I create TLSA records?

What are TLSA records?

TLSA Resource Records is a type of DNS Records. Assuming they're used with a DNSSEC-enabled domain they provide a way to ensure the authenticity of the X.509 certificate (normal certificate) provided by server the domain points to, without the need for a classic Certificate Authority. This is called DANE which stands for DNS-based Authentication of Named Entities.

There ore multiple "usages" defined which allows you to tell the user agent (e.g. a web browser) to trust your very own CA (cool huh?). They can be seen as a mix of SRV records and broader SSHFP records.

What does TLSA records look like?

TLSA Resource Records have a very simple structure, they specify which service (domain, IP protocol, port), a type of X.509 certificate and the corresponding Base64 encoded hash. Everything except for the Service Locator is bound the the certificate only and can be used together with many locators without any changes.

Service Locator

The service locator in typical DNS fashion, like the SRV record but instead of service name you specify the port (in this example TCP port 25).


Certificate Usage

Currently specified values are:

  • 0 - Certificate Authority Certificate. For pinning a CA Certificate the client already trusts, which is issuing the service certificate(s). (like a CAA record)
  • 1 - Service Certificate Constraint. For pinning a certificate issued by a CA the user agent already trusts.
  • 2 - Trust Anchor Assertion. Allows the usage of your own Certificate Authority.
  • 3 - Domain-Issued Certificate. Allows the usage of your own certificate. No other validation is done.

TLSA Selector

There are currently two different Selector Types for TLSA records and these are:

  • 0 - Full Certificate. The most precise Selector Type. (see RFC5280)
  • 1 - SubjectPublicKeyInfo. Less secure because it relies upon a CA, but the CA could be your own! (see RFC5280)

These are NOT related to the selectors for DKIM.

Matching Type

Allowed values are dofined in the IANA registry.

  • 0 - The entire certificate.
  • 1 - The SHA-256 hash of the certificate.
  • 2 - The SHA-512 hash of the certificate.


The hash of the certificate. If matching type is 0 the entire certificate is used instead.

How do I create TLSA records?

I came across a little helper called hash-slinger which can generate TLSA records using a pretty simple syntax.

$ tlsa --usage 1 --selector 1 --mtype 1 --certificate /path/to/certificate.pem example.com
_443._tcp.example.com. IN TLSA 1 1 1 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef012345

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.