TLSA Record Lookup Tool

Check TLSA records instantly across global resolvers to validate your DANE configuration and TLS certificate pins.

How to troubleshoot DANE and Certificate Pinning with a TLSA Lookup

TLSA records are used to cryptographically bind a TLS/SSL certificate to a domain name using DANE. Enter your domain name above to query its active TLSA records. Note: TLSA records are queried using a specific port and protocol format (e.g., _443._tcp.www.example.com or _25._tcp.mail.example.com). Ensure you query the exact hostname string.

Interpreting your TLSA results

  • DNSSEC Dependency: For a TLSA record to be trusted by clients, your domain must have DNSSEC enabled. If DNSSEC is broken or disabled, the TLSA record will be ignored.
  • Certificate Hash Mismatch: If the hash in your TLSA record does not mathematically match the SSL certificate currently installed on your server, strict DANE validators will reject the connection entirely. Always update your TLSA records before rolling over to a new certificate.
  • Usage, Selector, and Matching Type: The result will show three numbers before the hash (e.g., 3 1 1). These dictate how the client should verify the certificate (e.g., checking the exact public key vs the full certificate, using SHA-256 vs SHA-512).

TLSA record lookup for DANE

TLSA records are part of DANE and allow a domain to publish TLS certificate associations in DNS. They are stored under the _port._proto.hostname name, such as _443._tcp.example.com. TLSA is powerful but sensitive to formatting and certificate changes. This lookup helps confirm that the correct TLSA record is published and visible across resolvers.

Common TLSA issues include using the wrong port or protocol label, mismatched certificate data, or missing DNSSEC validation. Because TLSA is used in security-sensitive flows, even small errors can cause validation to fail. Always verify the record format and update it when certificates rotate.

If you need related checks, try SSL certificate check check tool and DNSSEC lookup validator.

TLSA is published at _port._proto.hostname. For HTTPS it is usually _443._tcp.example.com.

These fields define how the TLSA record maps to the certificate. Usage defines the validation model, selector chooses the certificate part, and matching type defines the hashing.

Yes. TLSA is only meaningful when DNSSEC validates the response. Without DNSSEC, clients should not trust TLSA.

TLSA records must be updated to match the new certificate or key. If they are stale, validation fails.

Yes. Multiple records can support key rollover or alternate certificates.

Using the wrong hostname or port label is the most frequent issue, followed by incorrect hash data.

CAA lookup DNSSEC lookup SSL/PKI DNS check

Related tools

SSL/PKI DNS check lookup SSL certificate check check tool CAA record lookup DNSSEC lookup validator