Mercurial > prosody-hg

changeset 14226:59c50c76860b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
util.prosodyctl.check: Show TLSA records in DNS Doesn't yet check that these match your certificates, but can be compared to 'check certs'
author Kim Alvefur <zash@zash.se>
date Fri, 12 Jun 2026 23:08:09 +0200
parents 866422587486
children f50685c55a1c
files util/prosodyctl/check.lua
diffstat 1 files changed, 7 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/util/prosodyctl/check.lua	Fri Jun 12 16:43:44 2026 +0200
+++ b/util/prosodyctl/check.lua	Fri Jun 12 23:08:09 2026 +0200
@@ -916,6 +916,7 @@
 		local s2s_ports = global:get_option_set("s2s_ports", {5269});
 		local c2s_tls_ports = global:get_option_set("c2s_direct_tls_ports", {});
 		local s2s_tls_ports = global:get_option_set("s2s_direct_tls_ports", {});
+		local use_dane = global:get_option_boolean("use_dane", true);
 
 		local global_enabled = set.new();
 		for host in enabled_hosts() do
@@ -1043,6 +1044,12 @@
 						if not ports:contains(record.srv.port) then
 							print("    SRV target " .. target .. " contains unknown " .. description .. " port: " .. record.srv.port);
 						end
+						if use_dane and res.secure then
+							local tlsa = dns.lookup("_"..record.srv.port.."._tcp."..target..".", "TLSA");
+							for i = 1, #tlsa do
+								print("    DANE: " .. tostring(tlsa[i]));
+							end
+						end
 					end
 				elseif required then
 					print("    No _" .. service .. " SRV record found for " .. domain .. ", but it looks like you need one.");