DANE

DANE guides and tutorials: authenticate TLS certificates via DNS using DNSSEC and TLSA records.

7 articles

March 2026

Timeline showing TLS certificate lifetime reduction from 398 to 47 days between 2026 and 2029

CaptainDNS · March 19, 2026

SC-081v3: 47-day TLS certificates, why it matters and how to prepare

The CA/Browser Forum voted to progressively reduce TLS certificate lifetimes from 398 to 47 days by March 2029. Timeline, rationale, impact, and practical guide.

Comparative diagram of MTA-STS and DANE protocols for email transport security

CaptainDNS · March 10, 2026

MTA-STS vs DANE: which protocol to choose for securing email transport?

MTA-STS uses HTTPS, DANE relies on DNSSEC. Both enforce mandatory TLS encryption between email servers, but they deploy differently. Complete comparison to make the right choice.

Diagram of the Microsoft 365 MX migration from mail.protection.outlook.com to mx.microsoft with DNSSEC

CaptainDNS · March 6, 2026

Microsoft 365 MX Migration to mx.microsoft: Automatic DNSSEC, Mandatory Graph API, and Action Items Before July 2026

Microsoft is changing DNS provisioning for Exchange Online domains. MX records are moving from mail.protection.outlook.com to mx.microsoft to streamline DNSSEC adoption. Here's what's changing and what you need to do.

February 2026

Diagram showing the DANE flow between an SMTP sender and Exchange Online with DNSSEC and TLSA

CaptainDNS · February 24, 2026

Deploy DANE for Exchange Online and Microsoft 365

Microsoft 365 has supported inbound DANE since 2024. This guide explains how to enable it, configure DNSSEC on your domain, and verify the deployment.

CaptainDNS · February 23, 2026

DANE/TLSA troubleshooting: diagnose and fix common errors

Your DANE setup broke after a certificate renewal? Learn how to identify and fix the 5 most common DANE/TLSA errors.

Architecture diagram showing Postfix, Bind9 and Let's Encrypt connected by DANE/TLSA

CaptainDNS · February 22, 2026

Set up DANE/TLSA with Postfix, Bind and Let's Encrypt

Step-by-step tutorial to deploy DANE on a self-hosted mail server with Postfix, Bind9, DNSSEC and Let's Encrypt.

DANE/TLSA: authenticating email server TLS certificates via DNS and DNSSEC

CaptainDNS · February 21, 2026

DANE/TLSA: the complete guide to authenticating email certificates via DNS

DANE (RFC 6698/7672) binds TLS certificates to domain names using DNSSEC-signed TLSA DNS records. Learn how to deploy it to secure SMTP transport.