The STARTTLS downgrade attack for SMTP. Without DANE (or MTA-STS), a receiving mail server accepts STARTTLS opportunistically — if the sender advertises it, TLS is used; if not, the message is delivered in plaintext. An on-path attacker can strip the STARTTLS advertisement, downgrading the connection. DANE lets the receiver require TLS by publishing a TLSA record; senders that support DANE will refuse to deliver without a validated cert.
All questions