DANE/TLSA
DANE (DNS-Based Authentication of Named Entities) uses a TLSA DNS record to publish exactly which TLS certificate, or which certificate authority, a server is supposed to present, so a connecting client can confirm the certificate it receives matches what the domain owner actually published instead of just trusting any certificate authority. It depends entirely on DNSSEC: without a signed, verifiable chain of trust for the TLSA record itself, an attacker who can forge DNS could also forge the pin, defeating the purpose. The most common real-world use is SMTP mail servers pinning their TLS certificate so other mail servers can detect a TLS downgrade or interception attempt during delivery, complementing MTA-STS, which achieves a similar goal through a web-hosted policy file instead of DNS. Browser support for DANE on the web has stayed limited, so its practical adoption today is concentrated in mail transport rather than general HTTPS.
By AdminKit team, Netbase JSC · Updated