What is DANE? DNS-Based Authentication of Named Entities Explained (2026)
Security Boulevard, Monday, April 20th, 2026
DANE is a DNS-based security protocol that validates TLS certificates using DNSSEC-signed TLSA records instead of relying on third-party CAs.
DANE (DNS-Based Authentication of Named Entities) is a security protocol that verifies TLS certificates directly through DNS using DNSSEC-secured TLSA records, eliminating dependence on third-party Certificate Authorities.
It addresses two major security issues: STARTTLS downgrade attacks where connections silently fall back to plaintext, and the risk of compromised or misissued certificates by allowing domain owners to define exactly which certificates are valid.
The protocol works by domain owners publishing TLSA records in their DNS zone, which are then cryptographically signed with DNSSEC to create a chain of trust that clients validate before accepting TLS connections.
While DANE adoption remains limited compared to alternatives like MTA-STS, it is increasingly used by government agencies, email providers, and organizations where email confidentiality is critical, with recent support announced by Microsoft in 2024.