What DANE does
DANE (DNS-based Authentication of Named Entities, RFC 7672) pursues the same goal as MTA-STS — enforced, verified TLS connections — but takes a different route. Instead of serving a policy over HTTPS, you publish a fingerprint of your mail server certificate directly in DNS, as a TLSA record at _25._tcp.mx-host.
The sending server fetches that record, verifies via DNSSEC that it is genuine, and compares it against the certificate the mail server presents during the TLS handshake. If they do not match, delivery does not happen. The decisive difference from MTA-STS: DANE does not depend on the trustworthiness of public certificate authorities — the entire chain of trust runs through DNSSEC.
What AnalyzeMy.Email checks
- TLSA records at
_25._tcp.{mx-host}for the domain's first three MX hosts - Record parameters: usage, selector and matching type of every entry found
- Presence per MX host — a single MX without a TLSA record leaves the protection incomplete
DANE or MTA-STS?
The two are not mutually exclusive — quite the opposite, many well-configured domains run both in parallel because different senders support different mechanisms.
- DANE requires a DNSSEC-signed zone. Without DNSSEC it is ineffective, because the TLSA record itself could be forged. Widespread in German-speaking countries, at providers like Posteo and Mailbox.org, and in public administration. Google supports DANE for outbound delivery.
- MTA-STS needs no DNSSEC, only a web server with a valid certificate. That is why large US providers such as Microsoft rely on it.
If you already run DNSSEC, DANE is the technically cleaner solution. Without DNSSEC there is no way around MTA-STS.
What to watch out for
- Certificate changes: every certificate replacement requires updating the TLSA record. Forgetting that makes your mail server unreachable for DANE-validating senders — a very real pitfall with 90-day Let's Encrypt certificates.
- Run the rollover properly: publish the new record alongside the old one before switching, and only remove the old one afterwards.
- Usage 3 1 1 (DANE-EE, SPKI, SHA-256) is the recommended combination for mail servers and survives a certificate change as long as the key stays the same.
- Cover every MX host — including backup MX servers.