All questions
Q & A Security · September 11, 2026

What is the difference between DANE and MTA-STS?

Both prevent SMTP STARTTLS downgrade. DANE requires DNSSEC on the zone and publishes cert pins in TLSA records. MTA-STS uses HTTPS + a DNS TXT record — no DNSSEC required, easier to deploy. Trade-offs: DANE has stronger cryptographic anchoring (DNSSEC chain of trust); MTA-STS has lower operational cost. Some SMTP receivers implement both; Postfix + Exim support both; Google Workspace supports MTA-STS but not DANE for inbound.

Read the full guide
What Is DANE? TLSA Records and DNS-Anchored TLS Explained
DANE pins your TLS certificate in DNS. If DNSSEC is signed, and the TLSA record matches the cert your service presents, receivers can trust the connection without depending only on public certificate authorities. It's the most-adopted alternative to CA-based PKI — but it lives mostly in SMTP.
Related questions
Do I need DNSSEC to use DANE? What problem does DANE solve? Which SMTP servers support DANE? Why isn't DANE used in browsers?