TLSA
TLSA record (DANE, RFC 6698 and RFC 7672). The name carries the port and protocol labels (_25._tcp.mail.example.com), data is the certificate association data as hexadecimal digits (blanks allowed, case ignored). The record is stored as usage selector matching_type data, the hex in lower case without blanks. The data must have the length of the chosen hash: 64 hex digits for SHA-256 (matching type 1), 128 for SHA-512 (matching type 2). Matching type 0 (full data) is accepted up to a stored length of 250 characters; use a hash for anything longer.
Fields
Section titled “Fields”| Field | Type | Required | Description |
|---|---|---|---|
type | type | yes | (A, AAAA, CNAME, CAA, ALIAS, TXT, MX, SRV, TLSA) |
name | fqdn_or_subdomain | yes | Fully Qualified Domain Name (FQDN) or subdomain. You can use the @ symbol to represent your apex domain (e.g., example.com). Wildcards are supported. |
ttl | ttl | no | Time To Live in seconds (60-86400) |
annotation | string | no | A custom note for this particular record. |
usage | integer | yes | Certificate usage: 0 PKIX-TA, 1 PKIX-EE, 2 DANE-TA, 3 DANE-EE. |
selector | integer | yes | Selector: 0 full certificate, 1 SubjectPublicKeyInfo. |
matching_type | integer | yes | Matching type: 0 exact match, 1 SHA-256, 2 SHA-512. |
data | string | yes | Certificate association data as hexadecimal digits. |
Example
Section titled “Example”{ "type": "A", "name": "www", "ttl": 600, "annotation": "string", "usage": 3, "selector": 1, "matching_type": 1, "data": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}