go.lumeweb.com/dane

Go library for DANE (DNS-based Authentication of Named Entities) and Handshake Name System support.

Features

• TLSA record generation (RFC 6698): Compute 3 1 1 records from PEM/DER certificates or raw SPKI bytes.
• DS record generation (RFC 4034): Keytag computation and SHA-256/384 digest from DNSKEY rdata.
• Self-signed certificate generation: EC P-256 keypair with configurable not-before/not-after.
• HNS utilities: SYNTH nameserver name construction (_synth._domainkey.hns) and domain normalization.
• PowerDNS zone formatting: Wallet resource records and authoritative zone snippets for HNS delegation.

Install

go get go.lumeweb.com/dane

Quick Start

package main

import (
    "fmt"
    "time"

    dane "go.lumeweb.com/dane"
)

func main() {
    certPEM, keyPEM, err := dane.GenerateSelfSignedECDSA(
        []string{"example.com"},
        time.Now().Add(24*time.Hour),
    )
    if err != nil {
        panic(err)
    }

    tlsa, err := dane.ComputeTLSAFromCert(certPEM)
    if err != nil {
        panic(err)
    }
    fmt.Println(tlsa) // hex digest
}

Documentation

See go.lumeweb.com/dane on pkg.go.dev.

License

MIT License — Copyright (c) 2026 Hammer Technologies LLC.