3 ms·
Just pointing out that MTA-STS doesn’t mitigate downgrade attacks and that DNSSEC/DANE does: https://www.rfc-editor.org/rfc/rfc7672.html#section-1.3.1 https://w
by alwillis 7y ago
Just pointing out that MTA-STS doesn’t mitigate downgrade attacks and that DNSSEC/DANE does: https://www.rfc-editor.org/rfc/rfc7672.html#section-1.3.1 https://www.rfc-editor.org/rfc/rfc7672.html#section-1.3.1
And right from the MTA-STS RFC: https://www.rfc-editor.org/rfc/rfc8461.html#section-2 https://www.rfc-editor.org/rfc/rfc8461.html#section-2
the mechanism described here instead relies on certification authorities (CAs) and does not require DNSSEC, at a cost of risking malicious downgrades.
So there’s that.