Skip to content

DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating. This checker looks up TLSA for each mail host, reports usage, selector, and matching type, and whether a trusted resolver set the AD bit. A TLSA record without DNSSEC is an unsigned claim, not a pin.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. A private assessment (see the checkbox in the scan dialog) is the only difference.

4.81%
of mail-enabled Top-1M domains publish TLSA for at least one MX
1.26%
reach a fully valid DANE state

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
SPF checker

SPF lists which hosts may send mail as your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

What is a DANE TLSA check?

For each MX host, SecLens.ONE looks up TLSA at _25._tcp.<mxhost> and reads usage, selector, and matching type. The recommended pin is 3 1 1 (DANE-EE, SPKI, SHA-256). Full credit also needs DNSSEC validation on that answer.

Why does DANE require DNSSEC?

Without a validated DNSSEC chain, an on-path attacker can forge TLSA answers. SecLens.ONE reports whether a trusted resolver set the AD bit. It does not open SMTP or match a live certificate itself.

Is any TLSA record enough?

No. Coverage must include the MX hosts that actually receive mail, the record must parse, and DNSSEC must validate. Full-cert pins (3 0 1) also break on ordinary CA re-issuance unless you automate DNS updates.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.