Opinion on TLSA/DANE recored

Hi togehter,

one of my s/qmail users has problems with the TLSA/DANE record for the following domain:

* excalibur.iks-jena.de

Here, I get the settings:

$ dnstlsa excalibur.iks-jena.de Usage: [2], Selector: [1], Type: [1] 10f34e8f08e446cc26d7d591184b51cb83791c869cef388be5d5cb58e2927f7a Usage: [2], Selector: [1], Type: [1] 3c9762932ec8e6e52d4b37504f15d90a3fac9930e1058170372b3a4b0e068a43

where the root FP is ok, the MTA's not.

Given the remarks in RFC 7672 section 3.1.2, I feel a bit uncomfortable about it.

Any opinions? Advices?

Regards. --eh.