> relatively easily Don't forget that DANE requires DNSSEC, which your DNS service provider must support (and switching DNS provider is not 'relatively easy').

> relatively easily Don't forget that DANE requires DNSSEC, which your DNS service provider must support (and switching DNS provider is not 'relatively easy'). Another problem with DNSSEC is that there are some people (and with 'some people' I mean tptacek) who are ferociously against it. Also, TLSA records require maintenance. If you forget to update them you will break things. Had to rotate your keys unexpectedly? Well now you have to wait for DNS propagation and explain your boss that some of your customers may get scary warning messages for a few hours when they try to reach you, and there will be nothing you can do about it.