From 17d2b78fb77fbc7d680310c197ebdeee7eec5e33 Mon Sep 17 00:00:00 2001 From: Dennis Baaten Date: Wed, 28 Aug 2019 08:48:54 +0200 Subject: [PATCH] Update DANE-for-SMTP-how-to.md --- DANE-for-SMTP-how-to.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/DANE-for-SMTP-how-to.md b/DANE-for-SMTP-how-to.md index 401700a..3d2a46b 100644 --- a/DANE-for-SMTP-how-to.md +++ b/DANE-for-SMTP-how-to.md @@ -82,6 +82,9 @@ The risks of SMTP with opportunistic TLS can be mitigated by using DANE: In short: DANE allows sending mail servers to unconditionally require STARTTLS with a matching certificate chain. Otherwise, the sending mail server aborts the connection and tries another server or defers the message. Receiving servers with published TLSA records, are therefore no longer vulnerable to the afore mentioned man in the middle attacks. +# DANE TLSA record example +![]() + # Advantages of DANE explained by illustrations ## Mail delivery: TLS without DANE The illustration below shows two TLS capable mail servers without using DANE. This scenario exposes the mail transport to the risks described above.