What is / Full version
DANE
A TLSA record associates a TLS certificate or public key with the name where the record is found. SMTP looks that name up at _25._tcp plus the mail host.
The SMTP name
RFC 7672 prefixes each candidate TLSA base domain with _<port>._tcp. For SMTP on port 25 and host mx.example.com, the query is _25._tcp.mx.example.com. IN TLSA.
If none of the candidate names yield a secure TLSA RRset, the SMTP client is free to use pre-DANE opportunistic TLS, and that can fall back to cleartext. Destinations that do not publish TLSA records continue to be sent that way.
Certificate usage
RFC 6698 defines four certificate usages. 0 is a CA constraint: the presented certificate has to pass PKIX path validation, and a matching CA has to sit on that path. 1 is a service certificate constraint: the end entity certificate has to pass PKIX and match the TLSA record.
2 is a trust-anchor assertion. 3 is a domain-issued certificate: the end entity certificate has to match the TLSA record, and PKIX path validation is not tested. Usage 1 and usage 3 both match the end entity certificate. Only usage 1 also requires PKIX validation.