DANE (DNS-Based Authentication of Named Entities) for email publishes a TLSA record at _25._tcp. that pins your mail server's TLS certificate or key. A sending server can then require authenticated TLS to your domain, closing the same downgrade gap MTA-STS addresses.

Does DANE need DNSSEC?

Yes. DANE only works on a DNSSEC-signed zone. Without DNSSEC a TLSA record can be stripped or forged in transit, so sending servers ignore it. If you cannot run DNSSEC, use MTA-STS instead.

DANE or MTA-STS, which should I use?

They solve the same problem two ways. DANE relies on DNSSEC; MTA-STS relies on the web PKI and an HTTPS policy file, so it works without DNSSEC. Large providers often use MTA-STS; DANE is common in Europe. You can publish both.

How do I check my DANE setup?

Enter your domain. dmarcula resolves your MX hosts, looks up the TLSA record at _25._tcp for each, and reports whether the records are present and DNSSEC-authenticated.

Tools

DANE checker.

Check a domain's inbound SMTP DANE: TLSA records on each MX host, and DNSSEC.

How to read your results

One TLSA record per mail server. DANE lives at _25._tcp.<your-mx-host> and pins that server's TLS certificate or key. Every MX host that receives mail should have one, or a sender can be downgraded to an unprotected host.

DNSSEC is not optional. A TLSA record on an unsigned zone can be stripped or forged in transit, so sending servers ignore it. "TLSA, not signed" means the record exists but does nothing until you turn on DNSSEC.

The numbers. A record like 3 1 1 is usage 3 (DANE-EE, pin this exact server), selector 1 (the public key), matching 1 (SHA-256). It is the most common and recommended combination for SMTP.

DANE or MTA-STS? Both stop TLS downgrade on mail to your domain. DANE needs DNSSEC; MTA-STS does not. If you have DNSSEC, publishing both is the strongest setup.

Frequently asked questions

What is DANE?: DANE (DNS-Based Authentication of Named Entities) for email publishes a TLSA record at _25._tcp.<mail-server> that pins your mail server's TLS certificate or key. A sending server can then require authenticated TLS to your domain, closing the same downgrade gap MTA-STS addresses.
Does DANE need DNSSEC?: Yes. DANE only works on a DNSSEC-signed zone. Without DNSSEC a TLSA record can be stripped or forged in transit, so sending servers ignore it. If you cannot run DNSSEC, use MTA-STS instead.
DANE or MTA-STS, which should I use?: They solve the same problem two ways. DANE relies on DNSSEC; MTA-STS relies on the web PKI and an HTTPS policy file, so it works without DNSSEC. Large providers often use MTA-STS; DANE is common in Europe. You can publish both.
How do I check my DANE setup?: Enter your domain. dmarcula resolves your MX hosts, looks up the TLSA record at _25._tcp for each, and reports whether the records are present and DNSSEC-authenticated.

This check is a snapshot. dmarcula watches your domain around the clock, reads the DMARC reports for you, and emails you when something changes. Free, no credit card.

Start monitoring free How it works