The TLSA record generator creates DANE TLSA records from your certificate, so mail servers and other clients can verify your server's certificate through DNSSEC.
Which service is the TLSA record for?
TLSA records are published under the port, protocol and hostname of the service, for example _25._tcp.mail.example.com for a mail server. DANE only works when the zone is signed with DNSSEC.
How should the certificate be matched?
For mail servers, 3 1 1 (DANE-EE, public key, SHA-256) is recommended. With the public key selector, the record stays valid when the certificate is renewed with the same key.
Paste the server certificate in PEM format. For usage 0 or 2, paste the CA certificate instead. If you paste a chain, the first certificate is used.
TLSA Record Generator