DANE (RFC 7672) — The gold standard for SMTP transport security:
- Binds TLS certificates directly to DNS via DNSSEC-signed TLSA records
- Eliminates TOFU vulnerability of MTA-STS
- Doesn't depend on certificate authorities
- Barrier: DNSSEC must be active across the entire DNS chain
- DANE and MTA-STS are complementary
SRS (Sender Rewriting Scheme) — Fixes SPF breakage during forwarding:
Original: MAIL FROM: alice@example.org
Forwarded: MAIL FROM: SRS0=HHH=TT=example.org=alice@forwarder.com
- Stateless (hash + timestamp for verification)
- Fixes SPF only — DKIM must still pass for DMARC
- Microsoft 365 uses SRS for all forwarded mail since August 2023
Sign in to keep track of what you have read.