🔍 DANE Verify
a small script that verifies TLSA records against live certificates via SMTP STARTTLS.
🤔 How it works
The check.sh script does the heavy lifting:
- Fetches TLSA records for a target host.
- Checks for
ad(Authentic Data) flag via DNSSEC. - Connects to the host via SMTP STARTTLS.
- Compares the live cert (or public key) hash with what's in your DNS.
🛠 Usage
Docker
You can run it manually to check a domain:
docker run --rm \
ghcr.io/eleith/containers-dane-verify \
mail.example.com:25 -r 8.8.8.8
Arguments:
hostname[:port]: The mail server to check. Port defaults to 25.-r resolver(Optional): The DNS resolver to use (e.g., 1.1.1.1).
📦 Tech Stack
- Base: Alpine Linux
- Tools:
openssl,bind-tools(dig),awk,bash