On this page

Setting Up DANE for Email

What it does

DANE (DNS-Based Authentication of Named Entities) lets you publish a record (TLSA) in DNS that tells other mail servers exactly which TLS certificate to expect from your mail server — an extra layer of protection against man-in-the-middle attacks, on top of standard certificate validation.

DANE is optional and more advanced than SPF, DKIM, DMARC, or DNSSEC. Most domains are not expected to have it, and it can't work at all without DNSSEC enabled first — see Enabling DNSSEC for Your Domain.

How to fix it

  1. Confirm DNSSEC is enabled and validating correctly on your domain — DANE will not work without it.
  2. Determine your mail server's TLS certificate details (this usually requires help from whoever manages your mail server, or your hosting provider's documentation).
  3. Generate a TLSA record using your certificate details (many DNS hosts and online tools can generate this for you once you provide the certificate).
  4. Publish the TLSA record in your DNS, typically at _25._tcp.mail.yourcompany.com (adjust the port and hostname to match your actual mail server).
  5. Re-run a scan to confirm the TLSA record validates against your mail server's certificate.

Should you set this up?

DANE adds real security value, but it comes with an ongoing maintenance cost: because it ties directly to your mail server's exact certificate, it can break if your provider rotates or renews the certificate without you updating the DNS record to match.

Only set this up if:

  • DNSSEC is already working correctly on your domain, and
  • You (or your provider) can commit to keeping the TLSA record in sync whenever the mail server's certificate changes.

If a scan flags a missing DANE record and you're not ready to take on that maintenance, it's reasonable to treat this as a lower-priority, optional improvement rather than an urgent fix.