tls.dane.missing

No DANE/TLSA Records

What we check

We query DNS for TLSA records at _25._tcp.<mx-hostname> for each MX target. DANE (DNS-Based Authentication of Named Entities) uses TLSA records to bind a TLS certificate to a hostname via DNSSEC, providing certificate verification without relying on the public CA system.

What this finding means

No TLSA records were found for the MX hostname. DANE is not configured. This is the default state for most domains — DANE adoption requires DNSSEC on the domain's zone, which most registrars and DNS providers do not enable by default.

Why it matters

No DANE protection. Without TLSA records, DANE-capable senders cannot verify the server's certificate against a DNS-published expectation. The connection falls back to opportunistic TLS, which is vulnerable to certificate-stripping MITM attacks.
Optional but valuable. DANE is the strongest available mechanism for authenticating SMTP connections — stronger than MTA-STS because it does not depend on the CA system and uses DNSSEC's chain of trust.
DNSSEC prerequisite. DANE only works when the domain's DNS zone is DNSSEC-signed. Deploying TLSA records without DNSSEC has no effect — DANE senders ignore unsigned TLSA records (RFC 7671 §4.1).

How to fix

Enable DNSSEC on your domain's DNS zone. This is typically done through your DNS provider or registrar. The zone must be fully signed before TLSA records have any effect.

Generate a TLSA record matching your mail server's certificate:

# For a Let's Encrypt certificate (DANE-EE, SPKI, SHA-256 = usage 3, selector 1, matching 1):
openssl x509 -in /etc/letsencrypt/live/mail.example.com/cert.pem -noout -pubkey | \
    openssl pkey -pubin -outform DER | sha256sum

Publish the TLSA record:

_25._tcp.mail.example.com.  IN  TLSA  3 1 1 <hex-hash-from-step-2>

Verify:

dig +short TLSA _25._tcp.mail.example.com

How it's graded

Missing DANE/TLSA records are an informational finding in the TLS panel with no direct deduction. The bonus category applies a separate 5-point deduction for absent DANE (bonus.dane.missing). See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TLSA _25._tcp.mail.example.com
(empty)
No DANE/TLSA records published for this MX hostname