Hacker News Reader

Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.

View on HN

To be fair, it’s used by only those who choose to use horrendous “mta-sts” instead of DNS-based Authentication of Named Entities (DANE).

I might add that if you want to enforce SMTP TLS, you can do just that without mta-sts or DANE.

So, basically everybody? DANE has virtually no uptake. I think it might literally just be Microsoft at this point?

When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.

Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended.

What concerns do you have with MTA-STS?

Reply on news.ycombinator.com