All questions
Q & A Security · September 11, 2026

What problem does DANE solve?

The STARTTLS downgrade attack for SMTP. Without DANE (or MTA-STS), a receiving mail server accepts STARTTLS opportunistically — if the sender advertises it, TLS is used; if not, the message is delivered in plaintext. An on-path attacker can strip the STARTTLS advertisement, downgrading the connection. DANE lets the receiver require TLS by publishing a TLSA record; senders that support DANE will refuse to deliver without a validated cert.

Read the full guide
What Is DANE? TLSA Records and DNS-Anchored TLS Explained
DANE pins your TLS certificate in DNS. If DNSSEC is signed, and the TLSA record matches the cert your service presents, receivers can trust the connection without depending only on public certificate authorities. It's the most-adopted alternative to CA-based PKI — but it lives mostly in SMTP.