tls.dane.unverified
DANE/TLSA Not Verified
What we check
We attempt to verify each TLSA record against the live TLS certificate. This finding is emitted when TLSA records exist but we could not complete verification — for example, the TLSA record uses a usage type or matching configuration that our verification cannot evaluate (such as DANE-TA with a trust anchor we cannot chain to).
What this finding means
TLSA records are published and may be valid, but we were unable to confirm or deny a match against the server's certificate. The DANE configuration is indeterminate from our perspective.
A DANE-capable sender with different verification capabilities (a different trust store, or direct DANE-TA chain resolution) might successfully verify these records.
Why it matters
- Incomplete result. The DANE status is unknown — the records may be correctly configured for senders that can evaluate them.
- No delivery impact from our side. We cannot flag this as a mismatch because we could not complete the check.
- Worth reviewing. If the TLSA records use an unusual configuration, verify that your intended senders can actually evaluate them.
Evidence example
TLSA record: 2 0 1 a1b2c3d4... (DANE-TA, full certificate, SHA-256)
Verification: not completed — trust anchor chain not evaluable