Hacker News Reader

Hacker News

Comment by philipwhiuk | Hacker News Reader

Full thread

philipwhiuk

Old version:

* DNS lookup for MX record

New version

* DNS lookup for A record

* HTTP request for .wellknown/htmp/known_hosts

Not sure why this is being considered as an improvement?

> each mailbox of a domain on a different provider

Why is this useful/necessary or even 'good'?

View on HN

Id think its for enduser flexibility and convenience. Its more involved to alter DNS records vs just adding a text line to a webpage and hitting that default endpoint as standard. Same way LetsEncrypt allows the easiest setup with the .wellknown endpoint , where a user may not have DNS access beyond the initial A record setup.

Why is one more involved than the other? DNS is just a text file too. And you might not even have a web server. Why should mail servers be required to also be web servers? And what if the web server for that domain is already a completely separate system, and now you force it to be linked to the email system?

Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.

To be fair, it’s used by only those who choose to use horrendous “mta-sts” instead of DNS-based Authentication of Named Entities (DANE).

I might add that if you want to enforce SMTP TLS, you can do just that without mta-sts or DANE.

So, basically everybody? DANE has virtually no uptake. I think it might literally just be Microsoft at this point?

When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.

Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended.

What concerns do you have with MTA-STS?

It's not a good idea, I'd call it terrible in fact. We have MX Records, might as well use those. If not, use SRV records. Requiring mail server to involved in root of the domain is terrible idea.

Reply on news.ycombinator.com