Tagged “dane”
3 articles
Email transport security: STARTTLS, MTA-STS, DANE
DMARC proves who sent a message, but it does nothing to protect that message while it crosses the internet. Here is how opportunistic STARTTLS, MTA-STS, DANE and TLS-RPT work together to keep inbound mail encrypted in transit, why STARTTLS alone is trivially downgraded, and the safe order to deploy enforcement without bouncing legitimate mail.
Read more
DANE and TLSA records explained
DANE pins your mail server's certificate in DNSSEC-signed TLSA records so senders refuse to deliver over a downgraded or substituted TLS connection. Here is how TLSA records work, how DNSSEC anchors the trust, how DANE compares with MTA-STS, and which one fits your domain.
Read more
MTA-STS vs DANE: which transport security to use
MTA-STS and DANE both stop SMTP downgrade attacks, but they anchor trust in opposite places: the web PKI versus DNSSEC. Here is how their trust models, failure behaviour and deployment burden differ, and a concrete guide to choosing one or running both.
Read more