On this page

Fixing DANE in Vodien for Microsoft 365

What this fixes

DANE lets receiving mail servers verify your mail server's certificate through DNS instead of a public CA. See Setting Up DANE for Email for the general mechanism — this guide covers the Microsoft 365 + Vodien specific path.

This isn't a record you hand-author. Vodien's DNS editor doesn't list TLSA among its supported record types, but that turns out not to matter here: Microsoft 365 supports "Inbound SMTP DANE with DNSSEC" as a managed feature where Microsoft provisions and publishes the TLSA record on its own infrastructure — not yours. What you actually need from Vodien is DNSSEC and a standard MX record.

Step 1: Enable DNSSEC

Vodien's own nameservers don't sign DNSSEC. Follow Fixing DNSSEC in Vodien first — this means moving DNS to an external nameserver that supports signing (e.g. Cloudflare), then having Vodien publish the resulting DS record via a support request. DANE cannot proceed until this is fully active and validating.

Step 2: Enable DNSSEC in Microsoft 365

  1. In Exchange Online PowerShell, run Enable-DnssecForVerifiedDomain for your domain.

Step 3: Swap in Microsoft's DANE-specific MX record

  1. Microsoft will provide a new MX target ending in .mx.microsoft (distinct from the standard mail.protection.outlook.com MX record).
  2. Add or edit this MX record in whichever DNS editor is now authoritative for your zone (Vodien's own editor if you kept DNS there while only outsourcing the DNSSEC signing, or your external nameserver's console if you moved DNS entirely).
  3. Once mail flow is confirmed working on the new MX record, remove the old mail.protection.outlook.com MX entry.

Step 4: Turn on inbound SMTP DANE

  1. In Exchange Online PowerShell, run Enable-SmtpDaneInbound for your domain.
  2. Microsoft automatically provisions the TLSA record on its .mx.microsoft hostname — Vodien's lack of TLSA support is not a blocker here, since you never create one yourself.
  3. Re-run your scan to confirm.

Limitations

  • Not supported for self-service/"viral" sign-up domains, or your tenant's own *.onmicrosoft.com domain.
  • Microsoft recommends keeping an MTA-STS policy active alongside DANE.
  • Given Vodien's DNSSEC path requires a support ticket rather than a dashboard toggle, budget extra time for this step specifically before attempting the Microsoft-side setup.

Common pitfalls

  • Assuming Vodien's lack of TLSA support rules this out entirely — it doesn't, since Microsoft handles the TLSA record itself.
  • Attempting the Microsoft 365 DANE steps before DNSSEC is confirmed fully active (not just submitted) — Vodien's support-ticket step can take longer than a self-service toggle, so verify propagation before moving on.