Your files stay on your device

# DANE TLSA generator and validator

Build a TLSA record from a pasted certificate, or look up published records over DNS-over-HTTPS and show the DNSSEC status the resolver reports.

Fill in the host and paste a certificate
The record is built here in the tab: the certificate is hashed locally, nothing is sent anywhere.

A TLSA record is only as trustworthy as the DNS carrying it. This page reads the resolver's Authenticated Data bit and reports it plainly; a record that arrives without DNSSEC validation is shown as unvalidated and is never called protective. Browsers do not implement DANE at all, so the records matter for SMTP, XMPP, and other services whose clients check them. When you rotate certificates, publish the new record and let old TTLs expire before the new certificate goes live; the selector 1 form spares you that dance whenever the key pair stays the same.
Options

## More network tools

- [Certificate & CSR](/web/certificate)
- [Live DNS lookup](/network/dns)
[All network tools](/network)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/dane-tlsa-generator-validator
Markdown version: https://nutter.tools/network/dane-tlsa-generator-validator.md
Plain-text version: https://nutter.tools/network/dane-tlsa-generator-validator.txt
Agent index: https://nutter.tools/llms.txt