HACKER Q&A
📣 unilynx

Which SMTP SaaS Supports DANE?


There are plenty of SMTP providers out there ... AWS SES, Postmark, Sendgrid...

But is there any provider out there which supports DANE on outgoing email, ie. enforcing STARTTLS if the recipient domain requests so ?

(It seems governments and domain name registries love talking about DANE, but few actual email providers care to implement it)

  👤 tptacek Accepted Answer ✓
The major mail providers got together and standardized MTA-STS, because none of them are DNSSEC-signing their normal zones, because DNSSEC is (1) not very good and (2) has an annoying tendency of screwing up and taking whole zones off the Internet for hours at a time.
👤 necovek
What makes you think a particular provider supports or doesn't support DANE?

Have you tested with a target SMTP server that is:

a. Properly configured for DANE

b. Misconfigured (eg. TLSA record conflicts what the server requires for TLS) to simulate MITM attack

c. Unconfigured to simulate downgrade attack

In essence, it seems simple enough that I would expect all larger providers to respect DANE, so I am curious what makes you think they aren't?