DANE SMTP Configuration Guide
DANE (DNS-based Authentication of Named Entities) binds TLS to DNS using TLSA records, providing cryptographic assurance of the TLS certificate presented by the SMTP server. When combined with DNSSEC, DANE helps prevent downgrade attacks and ensures that opportunistic TLS upgrades are validated against known keys.
Prerequisites
- DNSSEC must be enabled and correctly signed for your domain.
- Your SMTP server should present a certificate with stable keys.
- Understand TLSA parameters:
usage, selector, and matching.
Record Structure
Typical TLSA records are published under _25._tcp.mail.example.com for SMTP on port 25. A common configuration is:
_25._tcp.mail.example.com. IN TLSA 3 1 1 <SHA-256 of public key>
Here, usage 3 indicates DANE-EE (end-entity), selector 1 selects the public key, and matching 1 is a SHA-256 digest.
Generating the Digest
openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256
Postfix Configuration
Enable DANE in Postfix:
smtpd_tls_security_level = dane
smtp_tls_security_level = dane
smtp_dns_support_level = dnssec
Restart the service and test outbound delivery. Use postfix logs to confirm that TLSA validation is applied for recipient domains with signed records.
Testing and Validation
- Use OpenSSL and DNS tools to verify TLSA resolution.
- Audit DNSSEC chain of trust via dig +dnssec.
- Monitor SMTP logs for
DANE status lines and failures.
Best Practices
Rotate certificates carefully and keep TLSA records in sync. Consider staging new records before rotating keys. Maintain DNSSEC health to avoid validation breakage.
DANE significantly strengthens SMTP TLS, reducing MITM risk and improving security posture for high-value mail flows.
