DANE / TLSA record generator
Paste your MX server's certificate (PEM format) and we'll output the standard DANE-EE / SPKI / SHA-256 (3 1 1) TLSA record. That's the recommended profile for SMTP DANE: it pins the certificate's public key (so the cert can be re-issued without breaking the record) and uses SHA-256 (universally supported). We compute the hash on our server from the certificate you paste, over an encrypted connection, and never store or log it.
Example result for example.com
Sample data. Run the check above to see yours.
Your TLSA record
GeneratedPublish at _25._tcp.mx1.example.com once the zone is signed with DNSSEC.
_25._tcp.mx1.example.com TLSA
3 1 1 8cb0fc6c527506a053f4f14c8464bebbd6dede2738d11468dd953d7d6a3021f1
Why 3 1 1?
The three numbers are usage, selector, and matching type. 3 (DANE-EE) means "this hash is the leaf cert". Bypasses CA validation entirely. 1 (SPKI) hashes the SubjectPublicKeyInfo, which lets you re-issue the cert without changing the TLSA record as long as you keep the same key. 1 (SHA-256) is the universally-supported hash. Other profiles exist (e.g. 2 1 1 DANE-TA) but 3 1 1 is the most operationally friendly for SMTP.
Want ongoing monitoring?
This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.