# What Is DANE? Definition and Examples

> DANE is a protocol that uses DNSSEC-signed TLSA records to bind a TLS server's certificate or public key to its domain name.

Source: https://ssl.sh/glossary/dane/
Last updated: 2026-11-10

DANE is defined in [RFC 6698](https://www.rfc-editor.org/rfc/rfc6698), and its use for mail transfer is specified in RFC 7672. A domain owner publishes [TLSA](https://ssl.sh/glossary/tlsa/) records stating which certificate or key a service on a given port must present. Because those records are signed with [DNSSEC](https://ssl.sh/glossary/dnssec/), a client that validates DNSSEC can trust them without relying solely on the public CA system. Depending on the record's usage field, DANE either adds constraints to normal CA validation or replaces it, for example to authenticate a certificate from a private CA.

## Why it matters
Its main real-world deployment is SMTP between mail servers. Without DANE, a sending server that sees [STARTTLS](https://ssl.sh/glossary/starttls/) usually encrypts without verifying the certificate, and an attacker can strip TLS entirely. With DANE, a validating sender knows that TLS is mandatory for that destination and which key to expect, so downgrade and interception fail. Postfix and other common mail transfer agents support it. Browsers, by contrast, do not use DANE for HTTPS. The price is operational: DNSSEC must work at every level of the domain, and TLSA records must be updated before keys change, or mail delivery to the domain stops.

## Example
```bash
dig +dnssec TLSA _25._tcp.mail.example.com
# _25._tcp.mail.example.com. 3600 IN TLSA 3 1 1 <SHA-256 of the server public key>
# ... plus an RRSIG record, and the "ad" flag if your resolver validated it
```

## Common misconceptions
- **DANE works without DNSSEC.** DANE clients ignore unsigned TLSA records, since anyone able to spoof DNS could forge them.
- **Browsers check DANE.** No mainstream browser validates TLSA records for HTTPS; DANE matters mostly for mail.
- **DANE means CA-issued certificates are no longer needed.** Only the DANE-TA and DANE-EE usages bypass CA validation, and many operators keep publicly trusted certificates so that clients without DANE support still work.

## Related terms

- [TLSA 记录](https://ssl.sh/zh/glossary/tlsa/): TLSA 记录是一种 DNS 记录，声明某个端口和协议上的 TLS 服务必须出示哪张证书或哪个公钥，供 DANE 校验使用。
- [DNSSEC](https://ssl.sh/zh/glossary/dnssec/): DNSSEC 是一组 DNS 扩展，让解析器能沿着从根区开始的签名链，验证 DNS 应答确实来自权威方且未被篡改。
- [STARTTLS](https://ssl.sh/zh/glossary/starttls/): STARTTLS 是一条协议命令，用于把 SMTP、IMAP、POP3 等协议中已建立的明文连接，在同一端口上升级为 TLS 加密连接。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [自签名证书](https://ssl.sh/zh/glossary/self-signed-certificate/): 自签名证书是用自身私钥签名的证书，颁发者与主体相同，没有任何 CA 为它担保。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。