A TLSA record says which certificate or key is expected at a given host and port. For SMTP it lives under the MX hostname, and in practice it takes one shape.
Where it lives
_25._tcp.<mx-hostname>. IN TLSA <usage> <selector> <matching> <data>
^ ^
| transport
portUnder the MX host, not under the domain. A domain with three MX hosts needs TLSA records at three names, and each host’s zone must be signed.
The three numbers
| Field | Common value | Meaning |
|---|---|---|
| Usage | 3 | DANE-EE: this record names the end-entity certificate itself, and no CA is consulted. |
| Selector | 1 | Match the public key (SPKI) rather than the whole certificate. |
| Matching | 1 | The data is a SHA-256 digest rather than the full value. |
3 1 1 is the recommended combination for SMTP and is what every live deployment uses:
3 1 1 292481EEE04F9F5CE0DC1728488DEE2510053AF6D62F4E7CDEF8C82D811A5AE... 3 1 1 2A2413F46C23290866A3FB9C1658A404BCF6A71373D002A29D67C23ED8DF298...
Why 3 1 1 and not something else
| Choice | Why |
|---|---|
Usage 3 over 2 | Usage 2 pins a CA, which keeps you dependent on the web PKI. Usage 3 removes it entirely, which is the point of DANE. |
Selector 1 over 0 | Pinning the public key rather than the certificate means renewing the certificate with the same key needs no DNS change at all. |
Matching 1 over 0 | A digest keeps the record small. Publishing the full key or certificate makes an already-large record larger for no benefit. |
The selector choice has a direct operational consequence: with 3 1 1 you can renew indefinitely by reusing the key pair and never touch the TLSA record. Rotating the key requires the same publish-wait-switch dance as a DKIM rotation. RFC 7672 covers SMTP specifically.
Two records during a key change, never one
Publish the new key’s TLSA alongside the old one, wait out the TTL, switch the server, then remove the old record. A single record swapped in place means a window in which some senders hold a digest that does not match what your server presents — and a validating sender that cannot match refuses to deliver.