tls.dane.lookup_error
DANE/TLSA Lookup Failed
What we check
We query DNS for TLSA records at _25._tcp.<mx-hostname>. This finding is emitted when the DNS lookup returns a transient error (SERVFAIL, timeout) rather than a definitive answer. We cannot determine whether TLSA records exist.
What this finding means
The DNS query for TLSA records failed with a transient error. This does not mean TLSA records are absent — it means the authoritative DNS servers did not produce a usable answer at the time of the scan.
Why it matters
- Incomplete DANE assessment. Without a successful TLSA lookup, we cannot evaluate DANE status for this MX hostname.
- Potential DNSSEC issue. SERVFAIL on a TLSA query often indicates a broken DNSSEC chain on the zone — DNSSEC-validating resolvers return SERVFAIL when validation fails.
- No delivery impact. DANE senders treat a lookup failure the same as missing records — they fall back to opportunistic TLS.
How to fix
Check for DNSSEC validation failures:
dig +dnssec TLSA _25._tcp.mail.example.comVerify the zone's DNSSEC chain is intact if DNSSEC is enabled.
Re-run the scan after resolving DNS issues.
How it's graded
A DANE/TLSA lookup error is an informational finding with no grading penalty. See Grading Methodology for the full scoring model.
Evidence example
$ dig TLSA _25._tcp.mail.example.com
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL
TLSA lookup failed — DANE status indeterminate