Sending domain and authentication Optional

Pin mail TLS with DANE

If your domain is signed with DNSSEC, publish TLSA records for your MX hosts, so sending servers check the certificate through DNS.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

DANE for SMTP (RFC 7672) protects mail even when an attacker strips STARTTLS. It needs DNSSEC on the MX host's zone. Publish a _25._tcp TLSA record per MX host. Use 3 1 1 to pin the public key, and publish the new record before any key change.

Example

_25._tcp.mx.example.com.  3600  IN  TLSA  3 1 1 8cb0fc6c527506a053f4f14c8464bebbd6dede2738d11468dd953d7d6a3021f1

How to check

dig +dnssec TLSA _25._tcp.mx.example.com returns the record with the ad flag. A DANE checker, such as the one on internet.nl, reports the MX hosts as valid.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane.