DANE Checker

Verify the TLSA records that pin certificates on a domain's mail servers — DANE turns opportunistic SMTP TLS into authenticated TLS.

What gets checked

MX discovery — finds every mail server for the domain
TLSA records — reads _25._tcp.<mail-server> for each MX host
Record validity — usage, selector and matching-type ranges, hex data, hash lengths
Mode — DANE-EE (usage 3) is the recommended modern mode, independent of public CAs

Only public DNS records are read — nothing is stored. Missing TLSA is reported as a warning: DANE is still rare, and missing is not broken.