DANE / TLSA
DNS-based Authentication of Named Entities (DANE) lets domain owners publish their TLS certificate fingerprints directly in DNS, secured by DNSSEC.
Instead of trusting hundreds of third-party Certificate Authorities to vouch for a server's identity, DANE allows you to verify the certificate against a cryptographically signed DNS record. No middleman required.
TLSA Records Explained
A TLSA record is a DNS record that pins a TLS certificate (or its public key) to a domain name. When your browser or mail client connects to a DANE-enabled service, it:
- Queries DNS for a TLSA record at
_443._tcp.example.com - Validates DNSSEC signatures on the response to ensure the record has not been tampered with
- Compares the certificate presented by the server against the hash published in the TLSA record
- Establishes trust if they match, regardless of which CA signed the certificate
This means even a self-signed certificate can be fully trusted, as long as the DNS chain is intact.
How DANE Makes it Better
Simply put, DANE is a scalable system designed to ensure the website you visit is not malicious and you can be sure they are who they say they are.
It removes the need for a local store of "approved" root CA's. This results in a more free, open, secure, and decentralized Internet that's immune to censorship.
Traditionally, web browsers and any Internet enabled software that utilize TLS (transport layer security) keep a local database of root CA's. As you are probably thinking right now, it's a challenge to preload every CA in existence. The developers may not know about some lesser used ones.
This is why DANE exists. Rather than have the end-user (you) or a system administrator manually install missing Root CA's. A web browser that supports DANE can automatically use DNS to validate the TLS certificate installed on a website. This only works if the web hosting enables DANE on the website.
As of 2022, all Pacy World hosted websites that also host DNS with Pacy World have DANE automatically enabled. We publish TLSA records for all our services. If your software supports DANE verification (many mail servers already do), you get cryptographic proof of our identity without installing anything.
This is still a new emerging technology and not all browsers support it. If your browser (or any other software application) does not support DANE, you may want to kindly send a note informing them of how they could improve the user experience by implementing DANE.
If you can't use DANE:
View the instructions on how to add the Pacy World Root Certificate Authority into your browser or operating system.
Current Support
- Email (SMTP/IMAP): Most major mail servers (Postfix, Exim, Dovecot) support DANE verification natively. Your mail is already verified.
- Web browsers: Limited native support. Firefox had experimental support via
security.dane.enabled(removed in v68). We are building Bloom Browser with native DANE verification built in. Until then, install our Root CA for browser trust. - DNSSEC: All Pacy World zones are DNSSEC-signed. TLSA records are published for ports 25, 443, and 993.