3 ms·
DANE definitely works for SMTP. Chrome's efforts at stapling DANE failed, but I think for the wrong reasons.
by cryptonector 8y ago
DANE definitely works for SMTP. Chrome's efforts at stapling DANE failed, but I think for the wrong reasons.
- tptacek 8y agoNo. DANE did such a bad job for SMTP that the major email providers banded together and created an alternate, non-DNSSEC-dependent standard, MTA-STS, to work around it.
- cryptonector 8y agoI'm sorry, but that's nonsense. MTA-STS is about sites that are having trouble deploying DNSSEC. DNSSEC != DANE. DANE depends on DNSSEC.
- tptacek 8y agoNo, sorry, the MTA-STS draft itself is clear about this distinction. Also, your argument is circular. DANE definitely does not "work" for SMTP. The necessity for DNSSEC in SMTP is, I think, a desperate trope† that recognizes that the Web PKI has moved past considering DANE and begun investing in direct hardening for the X.509 system. SMTP is other mainstream protocol for which transport security couldn't be guaranteed, is mired in the late 1990s technologically, and doesn't inherit modern browser- and server- based protection. So: SMTP! SMTP is the reason we need DNSSEC! We must get DNSSEC deployed immediately so everyone can have secure SMTP! Except, you know who doesn't agree with you? The people who the most important email services. Hence: MTA-STS --- a standard whose introduction spells out its raison d'être: to avoid DANE! --- and the mooting of that last fragile argument for deploying DNSSEC. DANE is a dead letter. † I'm choosing words carefully