3 ms·

I'm sorry, but that's nonsense. MTA-STS is about sites that are having trouble deploying DNSSEC. DNSSEC != DANE. DANE depends on DNSSEC.

• tptacek 8y ago
  No, sorry, the MTA-STS draft itself is clear about this distinction. Also, your argument is circular. DANE definitely does not "work" for SMTP. The necessity for DNSSEC in SMTP is, I think, a desperate trope† that recognizes that the Web PKI has moved past considering DANE and begun investing in direct hardening for the X.509 system. SMTP is other mainstream protocol for which transport security couldn't be guaranteed, is mired in the late 1990s technologically, and doesn't inherit modern browser- and server- based protection. So: SMTP! SMTP is the reason we need DNSSEC! We must get DNSSEC deployed immediately so everyone can have secure SMTP! Except, you know who doesn't agree with you? The people who the most important email services. Hence: MTA-STS --- a standard whose introduction spells out its raison d'être: to avoid DANE! --- and the mooting of that last fragile argument for deploying DNSSEC. DANE is a dead letter. † I'm choosing words carefully