DANE

DANE, short for DNS-Based Authentication of Named Entities, uses TLSA records to associate a TLS service with a certificate, public key, or trust anchor. DNSSEC authenticates the DNS data. A supporting client enforces the association during TLS authentication. Depending on the selected usage, DANE can constrain a public certificate authority or authenticate a service independently of public CA trust. Merely publishing TLSA records does not protect clients that ignore DANE. Operators must coordinate key changes with TLSA updates and preserve DNSSEC validation.