On this page

Setting Up DANE for Email

What it does

DANE (DNS-Based Authentication of Named Entities) lets you publish a record (TLSA) in DNS that tells other mail servers exactly which TLS certificate to expect from your mail server — an extra layer of protection against man-in-the-middle attacks, on top of standard certificate validation.

DANE is optional and more advanced than SPF, DKIM, DMARC, or DNSSEC. Most domains are not expected to have it, and it can't work at all without DNSSEC enabled first — see Enabling DNSSEC for Your Domain.

If you use hosted email (Google Workspace or Microsoft 365), the steps below don't apply to you — your MX records point to your provider's own infrastructure, not a mail server you control, so you can't publish a TLSA record for it yourself. See the provider-specific guides below instead: Google Workspace doesn't support this at all (use MTA-STS), while Microsoft 365 supports it through a managed setup rather than a record you author by hand.

The steps below are for a self-hosted mail server, where your MX record points at a hostname on your own domain.

How to fix it (self-hosted mail only)

  1. Confirm DNSSEC is enabled and validating correctly on your domain — DANE will not work without it.
  2. Determine your mail server's TLS certificate details (this usually requires help from whoever manages your mail server).
  3. Generate a TLSA record using your certificate details (many DNS hosts and online tools can generate this for you once you provide the certificate).
  4. Publish the TLSA record in your DNS, typically at _25._tcp.mail.yourcompany.com (adjust the port and hostname to match your actual mail server).
  5. Re-run a scan to confirm the TLSA record validates against your mail server's certificate.

Should you set this up?

DANE adds real security value, but it comes with an ongoing maintenance cost: because it ties directly to your mail server's exact certificate, it can break if your provider rotates or renews the certificate without you updating the DNS record to match.

Only set this up if:

  • DNSSEC is already working correctly on your domain, and
  • You (or your provider) can commit to keeping the TLSA record in sync whenever the mail server's certificate changes.

If a scan flags a missing DANE record and you're not ready to take on that maintenance, it's reasonable to treat this as a lower-priority, optional improvement rather than an urgent fix.

If you use hosted email

Google Workspace Microsoft 365
Cloudflare Guide Guide
GoDaddy Guide Guide
AWS Route 53 Guide Guide
SiteGround Guide Guide
Vodien Guide Guide