ja:DANE

DANE (DNS-based Authentication of Named Entities) is a protocol to allow X.509 certificates, commonly used for Transport Layer Security (TLS), to be bound to DNS names using Domain Name System Security Extensions (DNSSEC) instead of (or in complement of) a pre-defined list of Certificate Authorities (CA).

TLSA resource record

The TLSA resource record is an own type of DNS record. It consists of port number and protocol of the service secured by it. An example record for port 25 over tcp could look like _25._tcp.example.com IN TLSA 3 0 1 $DATA. The TLSA parameters 3 0 1 are explaining the data following it. The first number is the Certificate Usage Field, the second is the Selector Field and the third is named Matching Type Field.The RR can also easily be generated with ldns-dane(1) from ldns.

SSHFP resource record

See OpenSSH#SSHFP record.

DANE supporting software

• Postfix

• Exim > 4.85

• Prosody (via prosody-mod-s2s-auth-dane)

See also

• DANE Validator

• Firefox extension to check DNSSEC/DANE status of websites

• Common implementation mistakes

• Generate TLSA records online