DANE
DNS-Based Authentication of Named Entities: publishing a mail server's certificate fingerprint in DNSSEC-signed TLSA records so senders can require and verify TLS.
What it means
DANE for SMTP (RFC 7672) lets a receiving domain announce, through DNS, that its MX hosts support TLS and which certificate or key they use. The domain signs its zone with DNSSEC and publishes a TLSA record at _25._tcp for each MX host. A sending server that finds a validated TLSA record must use STARTTLS and must check the certificate against it; if either fails, it does not deliver.
DNSSEC is what makes it trustworthy: unsigned TLSA records are ignored. For SMTP, RFC 7672 recommends the DANE-EE (3) and DANE-TA (2) usages, so no public certificate authority is needed.
Exchange Online supports DANE for outbound and inbound mail, and its failure codes appear in Microsoft's 5.7.32x range.
Example
_25._tcp.mx1.example.com. IN TLSA 3 1 1 0f8b...c6a2Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7672: SMTP Security via Opportunistic DANE TLSrfc-editor.org
- RFC 6698: The DNS-Based Authentication of Named Entities (DANE) TLS Protocol: TLSArfc-editor.org
- Microsoft Learn: How SMTP DANE workslearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes