API – TLSA Record Generator

The TLSA Record Generator offers a free JSON REST API to generate and check TLSA records programmatically. No authentication or API key is required. Rate limits apply. All endpoints accept both GET (query string) and POST (JSON body).

Base URL

https://api.tlsagenerator.com/v1

Response format

Every response is JSON with a top-level status field.

{ "api_version": "1", "status": "ok" | "error", ... }

On error, an errors array is included:

{ "api_version": "1", "status": "error", "errors": [ { "field": "hostname", "message": "Invalid or missing hostname." } ] }

field is the name of the invalid parameter, or null for non-field errors.

POST /v1/generate

Generate a TLSA DNS record. If no certificate is supplied, we connect to the server and fetch it automatically.

Parameters

Parameter	Required	Description
`hostname`	Yes	Fully qualified hostname, e.g. `smtp.example.com`
`port`	Yes	Port number (1–65535), e.g. `25`
`transport`	No	`tcp` (default) or `udp`
`usage`	Yes	0 = PKIX-TA, 1 = PKIX-EE, 2 = DANE-TA, 3 = DANE-EE
`selector`	Yes	0 = full certificate, 1 = subject public key (SPKI)
`mtype`	Yes	0 = no hash, 1 = SHA2-256, 2 = SHA2-512
`mode`	No	`direct` (default) or `starttls`. Only used when no certificate is supplied.
`certificate`	No	PEM certificate. If omitted, the server fetches it live using `hostname`, `port` and `mode`.

Example — auto-fetch certificate

curl -s "https://api.tlsagenerator.com/v1/generate?hostname=smtp.example.com&port=25&transport=tcp&usage=3&selector=1&mtype=1&mode=starttls" | jq

Example — POST with a certificate

curl -s -X POST https://api.tlsagenerator.com/v1/generate \ -H "Content-Type: application/json" \ -d '{ "hostname": "smtp.example.com", "port": 25, "transport": "tcp", "usage": 3, "selector": 1, "mtype": 1, "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----" }' | jq

Response

{ "api_version": "1", "status": "ok", "record": "_25._tcp.smtp.example.com. IN TLSA 3 1 1 aabb...", "hostname": "smtp.example.com", "transport": "tcp", "port": 25, "usage": 3, "selector": 1, "mtype": 1, "data": "aabb...", "certificate": { "subject": "CN=smtp.example.com", "issuer": "CN=R10,O=Let's Encrypt,C=US", "serial_number": "12345...", "valid_from": "2025-01-01T00:00:00+00:00", "valid_until": "2025-04-01T00:00:00+00:00" }, "usage_warning": null }

GET /v1/check

Look up the published TLSA record(s) for a hostname/port, connect to every resolved address independently, and report whether each server's certificate matches. Also reports DNSSEC validation status.

Parameters

Parameter	Required	Description
`hostname`	Yes	Fully qualified hostname, e.g. `smtp.example.com`
`port`	Yes	Port number (1–65535)
`transport`	No	`tcp` (default) or `udp`
`mode`	No	`direct` (default) or `starttls`

Example

curl -s "https://api.tlsagenerator.com/v1/check?hostname=smtp.example.com&port=25&transport=tcp&mode=starttls" | jq

Response

{ "api_version": "1", "status": "ok", "query_name": "_25._tcp.smtp.example.com", "dnssec_validated": true, "tlsa_records": [ { "record": "_25._tcp.smtp.example.com. IN TLSA 3 1 1 aabb...", "usage": 3, "selector": 1, "mtype": 1, "data": "aabb..." } ], "addresses": [ { "ip": "1.2.3.4", "error": null, "certificate": { "subject": "CN=smtp.example.com", "issuer": "CN=R10,O=Let's Encrypt,C=US", "serial_number": "12345...", "valid_from": "2025-01-01T00:00:00+00:00", "valid_until": "2025-04-01T00:00:00+00:00" }, "records": [ { "record_index": 0, "matches": true, "warning": null } ] } ] }

HTTP status codes

Code	Meaning
`200`	Success
`400`	Invalid parameters, or hostname resolves to a private/internal address
`404`	Endpoint not found
`405`	Method not allowed
`413`	Request body too large
`429`	Rate limit exceeded — 5 per minute, 60 per hour per IP
`502`	Could not reach the target server

Fair use

The API is free and requires no key. Requests are rate-limited to 5 per minute and 60 per hour per IP address.