DANE (DNS-Based Authentication of Named Entities, defined in RFC 6698) lets a domain publish the exact TLS certificate or public key its mail server is allowed to use. A sending server can then verify the certificate against DNS instead of relying solely on public certificate authorities.
For email, DANE works by publishing a TLSA record at _25._tcp.mail.example.com, matching the port and host of each MX target. When another mail server connects over SMTP and issues STARTTLS, it looks up the TLSA record and checks that the presented certificate matches. If it does not match, delivery is refused rather than downgraded to plaintext.
This matters because plain SMTP TLS is opportunistic: an attacker can strip STARTTLS and force unencrypted delivery. DANE closes that gap, but only when the DNS answers are trustworthy, so it requires DNSSEC on the domain. Without DNSSEC, the TLSA record could itself be forged.
To check DANE, confirm your zone is DNSSEC-signed and that a valid TLSA record exists for each MX host and port. Validate your TLSA records and review certificate fingerprints whenever you rotate certificates, as a stale TLSA record will block inbound mail.
Check it on your domain
- DANE Record Checker: look up TLSA records for DANE on a mail host.
- DNS Record Checker: look up any DNS record type for a host.