How does DANE interact with MTA-STS?
They are competing standards that solve the same problem. A sending server that supports both will prioritize DANE if it detects a valid DNSSEC signed TLSA record. If DANE validation fails or no TLSA record exists it may then check for an MTA STS policy.
Most large providers have chosen a single path. Gmail.com and Microsoft favor MTA STS as receivers. Many European providers prefer DANE. It is rare for a receiving domain to implement both side by side.
Need personalized help?
Get step-by-step instructions tailored to your setup. Open an AI assistant with your question pre-loaded — just add your details and send.
Was this answer helpful?
Thanks for your feedback!