# What Is TLSA Record (TLSA resource record)?

> TLSA records are DNS records that state which certificate or public key a TLS service on a given port must present, for use by DANE.

Source: https://ssl.sh/glossary/tlsa/
Last updated: 2026-11-10

A TLSA record lives at a name built from the port and transport protocol, such as `_25._tcp.mail.example.com` or `_443._tcp.example.com`, and has four fields. Certificate usage: 0 (PKIX-TA) and 1 (PKIX-EE) add constraints on top of normal CA validation, 2 (DANE-TA) names a trust anchor, and 3 (DANE-EE) matches the server's own certificate or key without any CA check. Selector: 0 for the full certificate, 1 for the SubjectPublicKeyInfo. Matching type: 0 for exact data, 1 for SHA-256, 2 for SHA-512. The last field is the association data itself. TLSA only has meaning when signed with [DNSSEC](https://ssl.sh/glossary/dnssec/), as part of [DANE](https://ssl.sh/glossary/dane/).

## Why it matters
The parameters decide how painful certificate renewal will be. The widely recommended `3 1 1` (DANE-EE, public key, SHA-256) matches only the key, so renewing a certificate with the same key needs no DNS change. If your ACME client generates a new key on every renewal, as certbot does by default unless `--reuse-key` is set, the record must be updated first, or validating senders will refuse to deliver mail. The safe rollover is to publish the new key's hash alongside the old one, wait for DNS caches to expire, and only then switch keys.

## Example
```bash
# selector 1 + matching type 1: SHA-256 of the public key
openssl x509 -in cert.pem -noout -pubkey \
  | openssl pkey -pubin -outform der \
  | openssl dgst -sha256 | awk '{print $2}'
```

```text
_25._tcp.mail.example.com. 3600 IN TLSA 3 1 1 <64 hex characters from the command above>
```

The [TLSA generator](https://ssl.sh/tools/tlsa-generator/) builds the record from a certificate.

## Common misconceptions
- **The TLSA record must change at every renewal.** With selector 1 and an unchanged key, it does not.
- **TLSA records work without DNSSEC.** Validating clients ignore TLSA data that is not DNSSEC-signed.
- **One TLSA record covers the whole domain.** The owner name includes port and protocol, so each service, and each MX host, needs its own record.

## Related terms

- [DANE](https://ssl.sh/zh/glossary/dane/): DANE 是一种利用经 DNSSEC 签名的 TLSA 记录，把 TLS 服务器的证书或公钥与其域名绑定起来的协议。
- [DNSSEC](https://ssl.sh/zh/glossary/dnssec/): DNSSEC 是一组 DNS 扩展，让解析器能沿着从根区开始的签名链，验证 DNS 应答确实来自权威方且未被篡改。
- [STARTTLS](https://ssl.sh/zh/glossary/starttls/): STARTTLS 是一条协议命令，用于把 SMTP、IMAP、POP3 等协议中已建立的明文连接，在同一端口上升级为 TLS 加密连接。
- [公钥](https://ssl.sh/zh/glossary/public-key/): 公钥是非对称密钥对中可以公开的一半，写在证书里，供他人验证由对应私钥生成的签名。
- [证书指纹](https://ssl.sh/zh/glossary/certificate-fingerprint/): 证书指纹是对证书 DER 编码计算出的哈希值（通常用 SHA-256），用来唯一标识一张证书，它本身并不存储在证书里。
- [密钥轮换](https://ssl.sh/zh/glossary/key-rotation/): 密钥轮换是按计划或在安全事件后，用新生成的密钥替换旧密钥，以限制密钥泄露造成损失的做法。