What is the purpose of a TLSA record in DANE?

Question

Options

• ATo provide information about a TLS server
• BTo sign a TLS server's public key
• CTo authenticate a DNS server
• DTo map a domain name to an IP address

• B
  95% (37)
• C
  3% (1)
• D
  3% (1)

Explanation

TLSA records in DANE (DNS-Based Authentication of Named Entities) are used to bind and authenticate a TLS server's certificate or public key to a domain name via DNSSEC, essentially replacing reliance on traditional Certificate Authorities by letting the DNS infrastructure vouch for which key belongs to a domain. This makes B correct: the record publishes (and through DNSSEC, cryptographically backs) the TLS key/certificate, so clients can verify it directly from DNS.

Why the distractors are wrong:

• A is too vague - TLSA doesn't provide general server information; it specifically authenticates the TLS certificate/key.
• C is wrong - authenticating DNS servers is the job of DNSSEC itself (via DS/DNSKEY records), not TLSA.
• D is wrong - mapping domain names to IPs is the job of A/AAAA records.

Memory tip: Think of TLSA as "TLS Authentication" - the record lets DNSSEC vouch for a server's TLS key so you don't need to trust a CA. The acronym itself hints at its job: TLS Authentication.

No community discussion yet for this question.