---
title: "Generate a DANE TLSA record"
method: POST
path: "/dns/tlsa/generate"
tags: ["dns"]
---

# Generate a DANE TLSA record

`POST /dns/tlsa/generate`

## Request

- Base URL: `https://intodns.ai/api`
- URL: `https://intodns.ai/api/dns/tlsa/generate`
- Auth: none required

Hash a CERTIFICATE or SubjectPublicKeyInfo PUBLIC KEY PEM block into a TLSA record. Private keys and unsupported PEM labels are rejected. Profile 3 1 1 is recommended for SMTP; DANE requires a DNSSEC-signed zone.

## Request body

- object
  - `pem` string, required
  - `usage` 0 | 1 | 2 | 3
  - `selector` 0 | 1
  - `matching` 0 | 1 | 2
  - `host` string
  - `port` integer

## Response `200`

Generated TLSA record, hash, decoded profile, warnings, and DNS entry

- object

## Other responses

- `400`: Invalid PEM block or generator input

---

[API](https://skmtc.dev/intodns/apis/intodns-ai-api.md) · [All operations](https://skmtc.dev/intodns/apis/intodns-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/intodns/apis/intodns-ai-api/revisions/c6c196b2fb4c?raw)