DANE Record ValidatorDANE Record Validator API

OnlineCredit Usage:1 per callLive Data
avg: 314ms|p50: 297ms|p75: 325ms|p90: 359ms|p99: 427ms

Overview

To use DANE Record Validator, you need an API key. You can get one by creating a free account and visiting your dashboard.

POST Endpoint

URL
https://api.apiverve.com/v1/danevalidator

Example

How to call the DANE Record Validator API in different programming languages.

cURL Request
curl -X POST \
  "https://api.apiverve.com/v1/danevalidator" \
  -H "X-API-Key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "record": "_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
}'
JavaScript (Fetch API)
const response = await fetch('https://api.apiverve.com/v1/danevalidator', {
  method: 'POST',
  headers: {
    'X-API-Key': 'your_api_key_here',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    "record": "_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
})
});

const data = await response.json();
console.log(data);
Python (Requests)
import requests

headers = {
    'X-API-Key': 'your_api_key_here',
    'Content-Type': 'application/json'
}

payload = {
    "record": "_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
}

response = requests.post('https://api.apiverve.com/v1/danevalidator', headers=headers, json=payload)

data = response.json()
print(data)
Go (net/http)
package main

import (
    "fmt"
    "io"
    "net/http"
    "bytes"
    "encoding/json"
)

func main() {
    payload := map[string]interface{}{
        "record": "_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
    }

    jsonPayload, _ := json.Marshal(payload)
    req, _ := http.NewRequest("POST", "https://api.apiverve.com/v1/danevalidator", bytes.NewBuffer(jsonPayload))

    req.Header.Set("X-API-Key", "your_api_key_here")
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}
Example Response
{
  "status": "ok",
  "error": null,
  "data": {
    "raw_record": "_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",
    "parsed": {
      "name": "_443._tcp.example.com.",
      "port": 443,
      "protocol": "tcp",
      "hostname": "example.com",
      "ttl": 86400,
      "class": "IN",
      "usage": 3,
      "selector": 1,
      "matching": 1,
      "certificate_data": "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",
      "certificate_data_length": 64
    },
    "interpretation": {
      "usage": {
        "name": "DANE-EE",
        "description": "Domain-issued certificate",
        "full_description": "Certificate must exactly match the provided association data (most common)"
      },
      "selector": {
        "name": "SPKI",
        "description": "SubjectPublicKeyInfo",
        "full_description": "Match against the Subject Public Key Info (recommended)"
      },
      "matching": {
        "name": "SHA-256",
        "description": "SHA-256 hash",
        "full_description": "SHA-256 hash of the selected content (recommended)"
      },
      "security_level": "Recommended",
      "recommendation": "This is the recommended DANE configuration (DANE-EE + SPKI + SHA-256)"
    },
    "validation": {
      "is_valid": true,
      "certificate_data_format": "Valid hexadecimal",
      "certificate_data_length_valid": true
    }
  }
}

Authentication

The DANE Record Validator API requires authentication via API key. Include your API key in the request header:

Required Header
X-API-Key: your_api_key_here

Learn more about authentication →

Interactive API Playground

Test the DANE Record Validator API directly in your browser with live requests and responses.

Parameters

The following parameters are available for the DANE Record Validator API:

Validate DANE Record

ParameterTypeRequiredDescriptionDefaultExample
recordstringrequired
The DANE/TLSA record string to validate
-_443._tcp.example.com. 3600 IN TLSA 3 1 1 2bb183af273adee2e02d60ba7a0dc0efcf5e0a2af42dab7b3f8ba9c0def1f6c8

Response

The DANE Record Validator API returns responses in JSON, XML, YAML, and CSV formats. The JSON response is shown in the Example section above; alternative formats below.

Other Response Formats

XML Response
200 OK
<?xml version="1.0" encoding="UTF-8"?>
<response>
  <status>ok</status>
  <error xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>
  <data>
    <raw_record>_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF</raw_record>
    <parsed>
      <name>_443._tcp.example.com.</name>
      <port>443</port>
      <protocol>tcp</protocol>
      <hostname>example.com</hostname>
      <ttl>86400</ttl>
      <class>IN</class>
      <usage>3</usage>
      <selector>1</selector>
      <matching>1</matching>
      <certificate_data>0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF</certificate_data>
      <certificate_data_length>64</certificate_data_length>
    </parsed>
    <interpretation>
      <usage>
        <name>DANE-EE</name>
        <description>Domain-issued certificate</description>
        <full_description>Certificate must exactly match the provided association data (most common)</full_description>
      </usage>
      <selector>
        <name>SPKI</name>
        <description>SubjectPublicKeyInfo</description>
        <full_description>Match against the Subject Public Key Info (recommended)</full_description>
      </selector>
      <matching>
        <name>SHA-256</name>
        <description>SHA-256 hash</description>
        <full_description>SHA-256 hash of the selected content (recommended)</full_description>
      </matching>
      <security_level>Recommended</security_level>
      <recommendation>This is the recommended DANE configuration (DANE-EE + SPKI + SHA-256)</recommendation>
    </interpretation>
    <validation>
      <is_valid>true</is_valid>
      <certificate_data_format>Valid hexadecimal</certificate_data_format>
      <certificate_data_length_valid>true</certificate_data_length_valid>
    </validation>
  </data>
</response>
YAML Response
200 OK
status: ok
error: null
data:
  raw_record: >-
    _443._tcp.example.com. 86400 IN TLSA 3 1 1
    0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
  parsed:
    name: _443._tcp.example.com.
    port: 443
    protocol: tcp
    hostname: example.com
    ttl: 86400
    class: IN
    usage: 3
    selector: 1
    matching: 1
    certificate_data: 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
    certificate_data_length: 64
  interpretation:
    usage:
      name: DANE-EE
      description: Domain-issued certificate
      full_description: >-
        Certificate must exactly match the provided association data (most
        common)
    selector:
      name: SPKI
      description: SubjectPublicKeyInfo
      full_description: Match against the Subject Public Key Info (recommended)
    matching:
      name: SHA-256
      description: SHA-256 hash
      full_description: SHA-256 hash of the selected content (recommended)
    security_level: Recommended
    recommendation: This is the recommended DANE configuration (DANE-EE + SPKI + SHA-256)
  validation:
    is_valid: true
    certificate_data_format: Valid hexadecimal
    certificate_data_length_valid: true
CSV Response
200 OK
keyvalue
raw_record_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
parsed{name:_443._tcp.example.com.,port:443,protocol:tcp,hostname:example.com,ttl:86400,class:IN,usage:3,selector:1,matching:1,certificate_data:0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF,certificate_data_length:64}
interpretation{usage:{name:DANE-EE,description:Domain-issued certificate,full_description:Certificate must exactly match the provided association data (most common)},selector:{name:SPKI,description:SubjectPublicKeyInfo,full_description:Match against the Subject Public Key Info (recommended)},matching:{name:SHA-256,description:SHA-256 hash,full_description:SHA-256 hash of the selected content (recommended)},security_level:Recommended,recommendation:This is the recommended DANE configuration (DANE-EE + SPKI + SHA-256)}
validation{is_valid:true,certificate_data_format:Valid hexadecimal,certificate_data_length_valid:true}

Response Structure

All API responses follow a consistent structure with the following fields:

FieldTypeDescriptionExample
statusstringIndicates whether the request was successful ("ok") or failed ("error")ok
errorstring | nullContains error message if status is "error", otherwise nullnull
dataobject | nullContains the API response data if successful, otherwise null{...}

Learn more about response formats →

Response Data Fields

When the request is successful, the data object contains the following fields:

FieldTypeSample ValueDescription
raw_recordstring"_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
-
parsedobject{...}
-
â”” namestring"_443._tcp.example.com."
-
â”” portnumber443
-
â”” protocolstring"tcp"
-
â”” hostnamestring"example.com"
-
â”” ttlnumber86400
-
â”” classstring"IN"
-
â”” usagenumber3
-
â”” selectornumber1
-
â”” matchingnumber1
-
â”” certificate_datastring"0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
-
â”” certificate_data_lengthnumber64
-
interpretationobject{...}
-
â”” usageobject{...}
-
â”” namestring"DANE-EE"
-
â”” descriptionstring"Domain-issued certificate"
-
â”” full_descriptionstring"Certificate must exactly match the provided association data (most common)"
-
â”” selectorobject{...}
-
â”” namestring"SPKI"
-

Headers

Only X-API-Key is required. Optional headers include Accept for response format negotiation (JSON, XML, or YAML), User-Agent, and X-Request-ID for request tracing. See all request headers →

GraphQL AccessALPHA

Access DANE Record Validator through GraphQL to combine it with other API calls in a single request. Query only the dane record validator data you need with precise field selection, and orchestrate complex data fetching workflows.

Test DANE Record Validator in the GraphQL Explorer to confirm availability and experiment with queries.

Credit Cost: Each API called in your GraphQL query consumes its standard credit cost.

GraphQL Endpoint
POST https://api.apiverve.com/v1/graphql
GraphQL Query Example
query {
  danevalidator(
    input: {
      record: "_443._tcp.example.com. 86400 IN TLSA 3 1 1 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
    }
  ) {
    raw_record
    parsed {
      name
      port
      protocol
      hostname
      ttl
      class
      usage
      selector
      matching
      certificate_data
      certificate_data_length
    }
    interpretation {
      usage {
        name
        description
        full_description
      }
      selector {
        name
        description
        full_description
      }
      matching {
        name
        description
        full_description
      }
      security_level
      recommendation
    }
    validation {
      is_valid
      certificate_data_format
      certificate_data_length_valid
    }
  }
}

Note: Authentication is handled via the x-api-key header in your GraphQL request, not as a query parameter.

CORS Support

The DANE Record Validator API accepts cross-origin requests from any origin, so it can be called directly from browser-based applications without a proxy. See CORS support →

Rate Limiting

DANE Record Validator requests are throttled per minute on the Free plan and unthrottled on paid plans. Exceeding the limit returns 429 Too Many Requests; rate-limit usage is reported in the X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset response headers. See per-plan limits and best practices →

Error Codes

The DANE Record Validator API uses standard HTTP status codes — 200 on success, 400 for invalid parameters, 401 for missing or invalid keys, 403 for insufficient credits, 429 for rate-limit exhaustion, and 500/503 for server-side issues. Each error response includes an X-Request-ID header you can quote when contacting support. See full error handling guide →

SDKs for DANE Record Validator

Official DANE Record Validator packages on npm, PyPI, NuGet, and JitPack — plus a Postman collection and an OpenAPI spec. See the SDK guide →

No-Code Integrations

DANE Record Validator works with Zapier, Make, Pipedream, n8n, and Power Automate using the same API key. See setup guides →

Frequently Asked Questions

How do I get an API key for DANE Record Validator?
Sign up for a free account at dashboard.apiverve.com. Your API key will be automatically generated and available in your dashboard. The same key works for DANE Record Validator and all other APIVerve APIs. The free plan includes 1,000 credits plus a 500 credit bonus.
How many credits does DANE Record Validator cost?

Each successful DANE Record Validator API call consumes credits based on plan tier. Check the pricing section above for the exact credit cost. Failed requests and errors don't consume credits, so you only pay for successful dane record validator lookups.

Can I use DANE Record Validator in production?

The free plan is for testing and development only. For production use of DANE Record Validator, upgrade to a paid plan (Starter, Pro, or Mega) which includes commercial use rights, no attribution requirements, and guaranteed uptime SLAs. All paid plans are production-ready.

Can I use DANE Record Validator from a browser?
Yes! The DANE Record Validator API supports CORS with wildcard configuration, so you can call it directly from browser-based JavaScript without needing a proxy server. See the CORS section above for details.
What happens if I exceed my DANE Record Validator credit limit?

When you reach your monthly credit limit, DANE Record Validator API requests will return an error until you upgrade your plan or wait for the next billing cycle. You'll receive notifications at 80% and 95% usage to give you time to upgrade if needed.

What's Next?

Continue your journey with these recommended resources

Was this page helpful?