3 ms·
Read the draft dude. STS is designed to interoperate with DANE. Also, if you deploy your STS info via DNS you'll need DNSSEC validation to to ensure that what
by AndyMcConachie 11y ago
Read the draft dude. STS is designed to interoperate with DANE.
Also, if you deploy your STS info via DNS you'll need DNSSEC validation to to ensure that what you read in DNS is actually what the zone holder put there. Without DNSSEC how does a sending SMTP daemon trust the STS policy of the recipient zone. STS policies are stored in DNS TXT records, or their own new RR.
- tptacek 11y agoPleaee don't be rude. STS doesn't preclude DANE, but it doesn't require it either. Meanwhile, this use case was the last remaining one motivating DANE at all.
- soetis1 11y agoThe draft is very clear about DANE being preferred from both a security and deployment perspective (does't need to get certificates for all hosted domains). Sure, if DNSSEC fail, then SMTP-STS is better than nothing. I'm pretty sure that the big providers could have had deployed DNSSEC relatively easily, if they just wanted to. I think other DNS-based email security features such as DKIM and DMARC motivates DNSSEC as well.