DNSSECTLSAbased

DNSSECTLSAbased refers to the use of DNSSEC-protected TLSA records to authenticate TLS connections, a concept commonly known as DANE (DNS-Based Authentication of Named Entities). In this approach, a domain publishes TLSA records in the DNS to indicate which TLS certificates or public keys should be trusted for a given service, such as a website or mail server. The DNS records themselves are secured by DNSSEC, providing an authenticated chain of trust from the domain’s DNS zone to the service.

How it works: When a client connects to a TLS service, it can perform a DNS query for the TLSA record of that service (for example, _443._tcp.example.com). If DNSSEC validates, the TLSA data can be used during the TLS handshake to verify the server’s certificate. A TLSA record contains fields such as usage (how the data should be interpreted in relation to the certificate chain), selector (which part of the certificate is used), and matching type (whether the data is a full certificate or a hash, like SHA-256 or SHA-512). Depending on the configuration, the client checks that the server’s certificate or its public key matches the TLSA data.

Use cases and limitations: DNSSECTLSAbased deployments are most discussed for securing SMTP/TLS (DANE for mail) and for services where operators want to pin exact certificates or keys. Adoption is limited by DNSSEC deployment, client and server support, and management overhead. Misconfigurations can cause service outages, so careful planning and monitoring are essential.

See also: DNSSEC, TLSA, DANE, RFC 6698.