All questions
Q & A Security · September 11, 2026

Why isn't DANE used in browsers?

Chrome removed DANE support in 2015 after the DNSSEC adoption failed to reach critical mass on the browser-facing web. Firefox never supported it natively. Reasons: performance impact of DNSSEC lookups on every HTTPS connection, low DNSSEC adoption rate, and the perception that certificate transparency + HPKP (later killed) + browser CA management addressed the same problem. Result: DANE is now essentially an SMTP-only technology.

Read the full guide
What Is DANE? TLSA Records and DNS-Anchored TLS Explained
DANE pins your TLS certificate in DNS. If DNSSEC is signed, and the TLSA record matches the cert your service presents, receivers can trust the connection without depending only on public certificate authorities. It's the most-adopted alternative to CA-based PKI — but it lives mostly in SMTP.
Related questions
Do I need DNSSEC to use DANE? What is the difference between DANE and MTA-STS? What problem does DANE solve? Which SMTP servers support DANE?