---
title: "Pin mail TLS with DANE · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane
updated: 2026-10-20
licence: "All rights reserved"
---

# Pin mail TLS with DANE

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: If your domain is signed with DNSSEC, publish TLSA records for your MX hosts, so sending servers check the certificate through DNS.
- How: DANE for SMTP (RFC 7672) protects mail even when an attacker strips STARTTLS. It needs DNSSEC on the MX host's zone. Publish a `_25._tcp` TLSA record per MX host. Use `3 1 1` to pin the public key, and publish the new record before any key change.
- Check: `dig +dnssec TLSA _25._tcp.mx.example.com` returns the record with the `ad` flag. A DANE checker, such as the one on internet.nl, reports the MX hosts as valid.

Example:

```dns
_25._tcp.mx.example.com.  3600  IN  TLSA  3 1 1 8cb0fc6c527506a053f4f14c8464bebbd6dede2738d11468dd953d7d6a3021f1
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane`.

- Previous: [Send and receive over TLS](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-tls)
- Next: [Keep authentication through forwarders with ARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/arc)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)