Free email tool
See whether your mail servers publish DANE TLSA records, whether DNSSEC validates them, and whether they match the certificate the server actually presents.
Instant result, no email needed.
For each of the top two MX hosts, the _25._tcp TLSA record is read from a DNSSEC-validating resolver. Without DNSSEC validation, sending servers ignore TLSA, so that is shown separately. When TLSA is present, CloudSpex connects on port 25, starts TLS, and compares end-entity records (usage 3 or 1) with the certificate's public key or the certificate itself. Trust-anchor records (usage 2) need the full chain and are not verified here. No email is sent.
DANE's alternative for mail is MTA-STS: see the MTA-STS Checker. For DNSSEC itself, the DNSSEC Checker.
A TLSA record at _25._tcp.<mx host>, protected by DNSSEC, that tells sending servers which certificate your mail server must present. It turns opportunistic TLS into verified TLS and stops downgrade attacks.
Yes. TLSA records are only used when DNSSEC validates them; an unsigned TLSA record is ignored.
Senders that validate DANE (for example Postfix with DANE enabled, and many European providers) refuse to deliver. Always publish the new record before rotating the key or certificate.
Both protect inbound mail. DANE needs DNSSEC; MTA-STS needs an HTTPS policy file. Large providers such as Google and Microsoft support MTA-STS; DANE is widely used in Europe. You can publish both.
Add your domain to CloudSpex to monitor its mail and DNS setup continuously.
Start Monitoring Free