tls.dane.mismatch

DANE/TLSA Mismatch

What we check

We retrieve the TLSA records for each MX hostname, verify that they are DNSSEC-validated (the upstream resolver's AD bit is set), and then match them against the live TLS certificate presented by the server. This finding is emitted when a checkable TLSA record exists, DNSSEC validates, but the certificate does not match the TLSA constraint.

What this finding means

The domain publishes a DANE/TLSA record that is DNSSEC-signed and structurally valid, but the certificate the mail server presents does not match it. This is a real misconfiguration: DANE-enforcing senders will refuse to deliver mail because the DNS-published certificate expectation and the actual certificate disagree.

Common causes: the certificate was renewed or replaced without updating the TLSA record, or the TLSA record was copied from a different server.

Why it matters

Breaks delivery for DANE senders. Postfix (the most common DANE-enforcing MTA) and other DANE-aware senders will reject the connection outright — they trust the DNSSEC-signed TLSA record over the live certificate.
Worse than no DANE. Without TLSA records, DANE senders fall back to opportunistic TLS. With a mismatched TLSA record, they enforce a check that fails — delivery stops.
Immediate action required. This is not a theoretical risk — mail is actively bouncing for DANE-enforcing senders right now.

How to fix

Identify the current certificate hash:

openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com 2>/dev/null | \
    openssl x509 -noout -pubkey | openssl pkey -pubin -outform DER | sha256sum

Update the TLSA record to match the current certificate:

_25._tcp.mail.example.com.  IN  TLSA  3 1 1 <new-hash>

For automated renewals (Let's Encrypt), consider using TLSA usage 2 (DANE-TA, matching the CA) or pre-publishing the next certificate's hash before renewal.

Verify:

dig +short TLSA _25._tcp.mail.example.com
# Compare with the hash from step 1

How it's graded

A DANE/TLSA mismatch carries a 15-point deduction in the TLS category. See Grading Methodology for the full scoring model.

Evidence example

TLSA record: 3 1 1 a1b2c3d4e5f6...
Certificate SPKI hash: f6e5d4c3b2a1...
MISMATCH — DANE-enforcing senders will refuse delivery