Email · Fix guide
DANE is not configured for mail
- DANE
- DNS-based Authentication of Named Entities
- TLSA
- Transport Layer Security Authentication record
No TLSA record was found for the primary mail exchanger.
What does this test measure?
No TLSA record was found for the primary mail exchanger.
What to do next
- Deploy and validate DNSSEC first.
- Generate the TLSA record for each MX certificate and publish it at _25._tcp of that MX hostname.
- Plan certificate and TLSA rotations together.
How to verify the fix
Validate the TLSA record through a DNSSEC-aware resolver and test SMTP delivery.
When this result may be wrong
DANE is optional and mainly useful when every relevant MX and its DNS zone are managed carefully.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.