On this page

Fixing DANE in Vodien for Google Workspace

Why you can't fix this

DANE works by publishing a TLSA record on your mail server's own hostname, signed via DNSSEC. See Setting Up DANE for Email for the general mechanism.

Multiple blockers stack here:

  1. Google Workspace itself doesn't support inbound DANE. Your MX records point to Google's infrastructure (smtp.google.com, or the legacy aspmx.l.google.com set for older domains) — hostnames in google.com's zone, not yours.
  2. Vodien's DNS editor doesn't list TLSA among its supported record types (A, AAAA, CNAME, MX, TXT, SRV).
  3. Vodien's nameservers don't support DNSSEC signing — a hard prerequisite for DANE — without moving to an external nameserver first (see Fixing DNSSEC in Vodien).

Any one of these would block DANE on its own; together, there's no path forward for a Workspace-hosted domain here.

What to do instead

Google's documented mechanism for enforcing inbound transport security is MTA-STS, not DANE. Set this up via Menu → Apps → Google Workspace → Gmail → Advanced → MTA-STS in the Google Admin console — it requires only a TXT record and an HTTPS-hosted policy file, both of which Vodien can host without issue.

Common pitfalls

  • Assuming moving DNS to a TLSA-capable provider would fix this — it wouldn't; Google's lack of DANE support for Workspace is the deeper, unrelated blocker.