DANE vs MTA-STS: Which Should You Use to Secure Email in Transit?

STARTTLS is the standard for encrypting email in transit between mail servers. But STARTTLS is opportunistic — it can be stripped by an attacker in a man-in-the-middle position, forcing the connection to fall back to plaintext.

Both DANE and MTA-STS solve this by publishing an out-of-band policy that tells sending servers: 'You must use TLS to deliver email to us. If you can't establish a secure connection, don't deliver.'

DANE (DNS-Based Authentication of Named Entities) uses DNSSEC to publish TLSA records in DNS. These records specify which TLS certificate should be used for your mail server — a form of certificate pinning.

Sending mail servers that support DANE and find a TLSA record will only deliver if the TLS certificate matches the published record. An attacker can't substitute a fraudulent certificate because the expected certificate fingerprint is published in DNSSEC-protected DNS.

Requirement: DNSSEC must be enabled on your domain. Without DNSSEC, DANE provides no security benefit (the TLSA records could be forged).

Adoption: High in northern Europe (especially Netherlands and Germany); lower adoption in North America.

MTA-STS (Mail Transfer Agent Strict Transport Security) publishes a policy file over HTTPS specifying that TLS is required and listing valid MX hostnames. Sending servers fetch this policy over HTTPS and cache it.

Since the policy is fetched via HTTPS (protected by the CA certificate system), it can't be stripped. An attacker would need a fraudulent HTTPS certificate for mta-sts.yourdomain.com — significantly harder.

Requirement: A subdomain (mta-sts.yourdomain.com) serving a policy file over HTTPS. No DNSSEC required.

Adoption: Supported by Gmail and growing — easier to implement than DANE for most organizations.

Use MTA-STS if: - You don't have DNSSEC (most organizations) - You want broad compatibility - You prefer a simpler implementation - Gmail inbound protection is a priority

Use DANE if: - You already have DNSSEC enabled - You serve customers in northern Europe where DANE adoption is high - You want the strongest possible certificate pinning without relying on CAs

Use both if: - You have DNSSEC and want defense in depth - You serve a global customer base - Maximum security is a requirement

Neither requires the other — they're complementary, not competing standards.