After cleaning the havoc with the DS records currently plaguing the CWP gui and the zone code and adding the TLSA records via text editor this is how the giu mask turns out
The structure is rather similar to the DS records albeit the tail string is longer. Perhaps when fixing the DS support for TLSA could come along too?