How does DANE affect fallback behavior when DNSSEC fails?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Imagine you've just set up DANE on your domain, and your sending server checks your DNSSEC signature to validate your TLSA records. But the validation comes back broken. Here's what happens next, and it's important.
With regular TLS (STARTTLS), if something goes wrong, the server says "well, TLS failed, I'll just send in plaintext." It's not ideal, but at least your mail gets through. DANE doesn't do that. If DNSSEC validation fails, a DANE-aware server treats it as a hard security failure and refuses to deliver. Your email bounces. No fallback to plaintext. No "better luck next time."
Why the hard line? Because the whole point of DANE is that your certificate info is cryptographically verified. If that verification breaks (bad DNSSEC config, missing signatures, network issues returning SERVFAIL), the server can't trust that the TLSA record is legitimate. In DANE's security model, a broken chain means "stop, don't proceed." This is intentional, not a bug.
The tradeoff: DANE gives you stronger security, but it also means DNSSEC stability is critical. One misconfiguration on your DNS provider's side, or one moment of DNSSEC resolver issues, and your email can get stuck in limbo. That's why DANE sees most use in government and academic settings where DNS operations are rock-solid. For most commercial domains, the risk of a DNSSEC outage blocking delivery is just too high.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
