All questions
Q & A Security · September 11, 2026

Which SMTP servers support DANE?

Postfix (since 2.11), Exim (since 4.85), Sendmail (via patches), Halon, and PowerMTA. On the receiving side, deploying TLSA records is straightforward. On the sending side, most operators enable DANE checking in the smtpd config. Google Workspace + Microsoft 365 do not currently check DANE on outbound; they honor MTA-STS instead.

Read the full guide
What Is DANE? TLSA Records and DNS-Anchored TLS Explained
DANE pins your TLS certificate in DNS. If DNSSEC is signed, and the TLSA record matches the cert your service presents, receivers can trust the connection without depending only on public certificate authorities. It's the most-adopted alternative to CA-based PKI — but it lives mostly in SMTP.
Related questions
Do I need DNSSEC to use DANE? What is the difference between DANE and MTA-STS? What problem does DANE solve? Why isn't DANE used in browsers?