DMARC Engine
Glossary

DANE

DANE uses DNSSEC-signed DNS records to tell sending servers which TLS certificate a mail server should present.

DANE (DNS-Based Authentication of Named Entities, defined in RFC 6698) lets a domain publish the exact TLS certificate or public key its mail server is allowed to use. A sending server can then verify the certificate against DNS instead of relying solely on public certificate authorities.

For email, DANE works by publishing a TLSA record at _25._tcp.mail.example.com, matching the port and host of each MX target. When another mail server connects over SMTP and issues STARTTLS, it looks up the TLSA record and checks that the presented certificate matches. If it does not match, delivery is refused rather than downgraded to plaintext.

This matters because plain SMTP TLS is opportunistic: an attacker can strip STARTTLS and force unencrypted delivery. DANE closes that gap, but only when the DNS answers are trustworthy, so it requires DNSSEC on the domain. Without DNSSEC, the TLSA record could itself be forged.

To check DANE, confirm your zone is DNSSEC-signed and that a valid TLSA record exists for each MX host and port. Validate your TLSA records and review certificate fingerprints whenever you rotate certificates, as a stale TLSA record will block inbound mail.

Check it on your domain

Written and reviewed by the DMARC Engine team · Last reviewed June 2026

See where your domain stands today

Run a free DMARC scan, then let us take you to enforced p=reject with no email outage.