Privacy controls
CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.
Validate DANE (DNS-based Authentication of Named Entities) TLSA records for your domain. Verify TLS certificate pinning over DNSSEC without relying on traditional certificate authorities.
DANE (DNS-based Authentication of Named Entities) is a protocol that uses DNSSEC-signed TLSA records to authenticate TLS certificates without relying on traditional certificate authorities. It provides an additional layer of trust by binding certificates to DNS records, preventing fraudulent certificates from being accepted by validating clients.
DANE eliminates dependence on the CA trust model, prevents fraudulent certificate issuance, and provides a cryptographically verifiable alternative for certificate validation using DNSSEC.
Publishing TLSA records without DNSSEC, incorrect certificate hash values, not updating TLSA records after certificate renewal, and using usage=3 without pinning a specific CA are common errors.
Type your domain into the DANE checker.
We verify the domain zone is DNSSEC-signed.
We retrieve TLSA records from _port._tcp.yourdomain.
We check usage, selector, matching type, and certificate data.
Queries DNS for TLSA records under service-specific names like _443._tcp.yourdomain. Verifies the records exist and are properly formatted.
Checks that the domain zone is DNSSEC-signed. DANE is only secure when combined with DNSSEC; unsigned zones cannot prevent DNS spoofing of TLSA records.
Parses the TLSA usage field (0-3). Usage=3 (Domain-issued certificate / DANE-EE) is the most common and pins your exact certificate without CA dependency.
Checks the selector field (0=full certificate, 1=public key only). Selector=1 is recommended as it allows certificate renewal without updating the TLSA record.
Validates the matching type (0=exact match, 1=SHA-256 hash, 2=SHA-512 hash). SHA-256 (type 1) is recommended for compact, secure pinning.
Shows the raw certificate association data (hash or full certificate). Use this to verify your TLSA record matches your current certificate.
Automate DANE TLSA record checks, track DNSSEC signing status, and get alerted when TLSA records no longer match your certificates or DNSSEC validation fails.