tls.dane.valid
DANE/TLSA Validated
What we check
We retrieve the TLSA records for each MX hostname, verify DNSSEC authentication (AD bit), and match them against the live TLS certificate. This finding is emitted when the TLSA record is DNSSEC-signed and the certificate matches — DANE validation succeeds.
What this finding means
The mail server's TLS certificate is authenticated by a DNSSEC-signed TLSA record. DANE-enforcing senders can cryptographically verify that they are talking to the correct server, without relying on the public Certificate Authority system.
This is the strongest available form of SMTP transport authentication — it combines DNS-based trust (DNSSEC) with certificate pinning (TLSA).
Why it matters
- MITM protection. DANE prevents certificate-stripping and forged-certificate attacks that opportunistic TLS and even MTA-STS cannot fully defend against.
- CA-independent. The trust anchor is the DNSSEC chain, not a third-party CA. A compromised CA cannot issue a fake certificate that passes DANE validation.
- Best-in-class signal. Valid DANE is the highest trust tier for SMTP encryption. It signals a domain that has invested in both DNSSEC and correct TLSA record management.
Evidence example
TLSA record: 3 1 1 a1b2c3d4e5f6... (DANE-EE, SPKI, SHA-256)
DNSSEC: validated (AD bit set)
Certificate match: ✓
DANE validation successful