What is the recommended TLSA configuration for Let's Encrypt?

Usage `3` (DANE-EE), Selector `1` (SPKI), and Matching Type `1` (SHA-256). This pins the public key rather than the entire certificate, so renewals do not break DANE verification if the key is retained.

Updated: August 2026 • Verified v1.2

DNS TLSA (DANE) Record Generator for SSL/TLS & SMTP

Internet & NetworkNetwork

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

_[port]._[protocol].[domain]. IN TLSA [usage] [selector] [matching] [data]

Was this calculation helpful?

Understanding Your Results

Constructs valid `_port._protocol.domain.` record names, formats standard 3-1-1 (DANE-EE SPKI SHA-256) parameters, generates BIND zone entries, and provides ready-to-run OpenSSL fingerprint extraction commands.

Practical Guidance & Next Steps

Using Selector 1 (SPKI) rather than Selector 0 (Full Certificate) allows you to renew your Let's Encrypt SSL certificate without having to update your DNS TLSA record, as long as you reuse your private key.

What is this?

A network security utility that generates DNS TLSA records to bind SSL/TLS certificates directly to DNS via DNSSEC.

How does it work?

1. Enter host domain, port (25 for SMTP, 443 for HTTPS), and protocol. 2. Paste your certificate's SHA-256 fingerprint (or use the provided extraction command). 3. Copy the formatted BIND TLSA record and verify with `dig`.

Why use it?

Protects email transfer against man-in-the-middle downgrade attacks and satisfies European cybersecurity standards.

Technical Scope & Calculation Limitations

Generates RFC 6698 standard TLSA records.

Frequently Asked Questions

DANE (RFC 6698) uses DNSSEC to authenticate the TLS certificates of mail servers. It prevents opportunistic TLS downgrade attacks on SMTP port 25, ensuring email is transmitted with strict end-to-end encryption.

Windows Desktop & Widget Options