August 7, 2026
Signed, sealed, undelivered
How to Generate a TLSA Record and Fix the 3 1 1 Mismatch
Email admins are losing it over one tiny record that can make mail vanish
TLDR: The article shows admins how to fix a common setup mistake that can block secure email by publishing the right DNS record and matching it to the server’s key. Commenters loved the hands-on fix but roasted the wider email security maze as fragile, obscure, and prime 2 a.m. meltdown material.
A very specific corner of the internet just got its latest villain: a tiny DNS entry that can make email either glide through safely or disappear in a puff of admin rage. The guide explains how to create a TLSA record — basically a public note in your domain settings that tells other mail servers, “only trust this cryptographic key.” The big gotcha is the infamous 3 1 1 mismatch, which community members describe as the digital equivalent of “everything looks right until nothing gets delivered.” The article’s promise of “no theory, just commands” won a lot of applause from operators who are tired of 40-page specs when all they want is their mail working again.
The strongest reactions? One camp is cheering because this is a rare practical fix for a problem that quietly wrecks delivery. Another camp is dunking on the whole setup, saying the real reason almost nobody uses DANE — a security system for domain names and mail — is that getting DNSSEC turned on feels like a side quest from hell. A mini flame war broke out over certificate renewals too: veterans kept yelling that if you pin the whole certificate instead of just the key, you’re basically scheduling your own future outage. In plainer English: one wrong choice now, one panicked weekend later.
And yes, the jokes flew. People compared the error to “entering the right password in the wrong universe,” while others called email security an escape room designed by sadists. The mood was equal parts grateful, traumatized, and weirdly proud that three commands can fix a mess that has sent countless admins doom-searching at 2 a.m.
Key Points
- •The article explains that a TLSA record for SMTP pins a mail server’s TLS certificate in DNS and that the most common recommended form is 3 1 1 under DANE.
- •3 1 1 means certificate usage 3 (DANE-EE), selector 1 (SPKI/public key), and matching type 1 (SHA-256).
- •For SMTP, the article says only TLSA usages 2 and 3 are usable, while RFC 7672 advises against using PKIX-TA (0) and PKIX-EE (1).
- •The guide provides OpenSSL commands to extract a certificate’s public key, convert it to DER, hash it with SHA-256, and use the resulting 64-character hex digest as the TLSA value.
- •The article warns that selector 0 variants such as 3 0 1 hash the full certificate and therefore change on every certificate renewal, making mismatches more likely.