News for hackers. Stuff that matters.

A comment on What it means to see a 'bad' certificate in TLS Certificate Transparency logs. Parent comment

Re:What it means to see a 'bad' certificate in TLS Certifica... by Koenvh on Monday October 17, 2022 @08:00AM (#33232372)
DANE is gaining adoption primarily when it comes to email - browsers are still hesitant.
[ Parent | on HN ]
Re:What it means to see a 'bad' certificate in TLS Certifica... by LeonM on Monday October 17, 2022 @08:36AM (#33232651)
I don't understand why you are being downvoted, since you are right.

For example: Microsoft has recently adopted DANE validation for outbound email, are planning to add TLSA records for their inbound email 'by the end of 2022. [0]

[0] https://techcommunity.microsoft.com/t5/exchange-team-blog/re...

[ Parent | on HN ]
Re:What it means to see a 'bad' certificate in TLS Certifica... by tptacek on Monday October 17, 2022 @11:07AM (#33234525)
Browsers have refused to implement DANE for the last ten years. In the meantime, the major email players came up with MTA-STS, and alternative to DANE that cites lack of DNSSEC adoption as one of its rationales.

If you send email today, it's vanishingly unlikely that any DNSSEC will happen; email is complicated and email infrastructure tends to shut people's brains off (I know it does for me) but you can just look at the tiny slice of domains that are actually DNSSEC signed and see that there's no meaningful adoption.

[ Parent | on HN ]