DANE TLSA generator and validator

A TLSA record is only as trustworthy as the DNS carrying it. This page reads the resolver's Authenticated Data bit and reports it plainly; a record that arrives without DNSSEC validation is shown as unvalidated and is never called protective. Browsers do not implement DANE at all, so the records matter for SMTP, XMPP, and other services whose clients check them. When you rotate certificates, publish the new record and let old TTLs expire before the new certificate goes live; the selector 1 form spares you that dance whenever the key pair stays the same.