DANE (DNS-Based Authentication of Named Entities) uses DNSSEC-signed TLSA records to tell sending servers exactly which TLS certificate to expect, forcing encrypted, authenticated SMTP delivery. It’s an alternative/complement to MTA-STS; DANE requires DNSSEC, while MTA-STS uses HTTPS-published policy instead.
Both prevent downgrade attacks on mail transport. DANE relies on DNSSEC + TLSA records; MTA-STS relies on an HTTPS policy file and a TXT record. Organizations with DNSSEC often deploy DANE; those without typically choose MTA-STS.
DANE is common in government, finance and among large mail operators that already run DNSSEC. It requires careful certificate and TLSA-record management to avoid breaking delivery.
Check your MTA-STS record now
Open the free MTA-STS checker →You can publish both for maximum compatibility, but many organizations choose one based on whether they run DNSSEC. Pair either with TLS-RPT for reporting.
