RFC 7672

SMTP Security via Opportunistic DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS)

📅 published October 2015, from ietf

RFC 7672: SMTP Security via Opportunistic DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) 🎀

okay bestie, this is RFC 7672 💖 It's a Standards Track doc from the IETF, published in October 2015. The authors are V. Dukhovni (Two Sigma) and W. Hardaker (Parsons). It's marked as ISSN 2070-1721. The header doesn't list anything it obsoletes or updates, so it's standing on its own 🌸

Abstract ✨

okay so this memo lays out a downgrade-resistant way for SMTP transport security between Message Transfer Agents (MTAs, the servers that pass your emails along) 📬. It's built on the DNS-Based Authentication of Named Entities (DANE) TLSA DNS record. The big payoff: email backbone can slowly move over to encrypted and authenticated Transport Layer Security (TLS), one step at a time 🦋

Status of This Memo 🧾

this is an Internet Standards Track document 💅

it's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). for more on Internet Standards, check Section 2 of RFC 5741 🌈

for the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7672 🔗

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. 💜

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. please read those carefully, because they spell out your rights and restrictions for this doc. any Code Components pulled out of this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🫶

Table of Contents 📚

1. Introduction ....................................................3
   1.1. Terminology ................................................4
   1.2. Background .................................................6
   1.3. SMTP Channel Security ......................................6
        1.3.1. STARTTLS Downgrade Attack ...........................7
        1.3.2. Insecure Server Name without DNSSEC .................7
        1.3.3. Sender Policy Does Not Scale ........................8
        1.3.4. Too Many Certification Authorities ..................9
2. Identifying Applicable TLSA Records .............................9
   2.1. DNS Considerations .........................................9
        2.1.1. DNS Errors, "Bogus" Responses, and
               "Indeterminate" Responses ...........................9
        2.1.2. DNS Error Handling .................................11
        2.1.3. Stub Resolver Considerations .......................12
   2.2. TLS Discovery .............................................13
        2.2.1. MX Resolution ......................................14
        2.2.2. Non-MX Destinations ................................16
        2.2.3. TLSA Record Lookup .................................18
3. DANE Authentication ............................................20
   3.1. TLSA Certificate Usages ...................................20
        3.1.1. Certificate Usage DANE-EE(3) .......................21
        3.1.2. Certificate Usage DANE-TA(2) .......................22
        3.1.3. Certificate Usages PKIX-TA(0) and PKIX-EE(1) .......23
   3.2. Certificate Matching ......................................24
        3.2.1. DANE-EE(3) Name Checks .............................24
        3.2.2. DANE-TA(2) Name Checks .............................24
        3.2.3. Reference Identifier Matching ......................25
4. Server Key Management ..........................................26
5. Digest Algorithm Agility .......................................27
6. Mandatory TLS Security .........................................27
7. Note on DANE for Message User Agents ...........................28
8. Interoperability Considerations ................................28
   8.1. SNI Support ...............................................28
   8.2. Anonymous TLS Cipher Suites ...............................29
9. Operational Considerations .....................................29
   9.1. Client Operational Considerations .........................29
   9.2. Publisher Operational Considerations ......................30
10. Security Considerations .......................................30
11. References ....................................................31
   11.1. Normative References .....................................31
   11.2. Informative References ...................................33
Acknowledgements ..................................................34
Authors' Addresses ................................................34

1. Introduction ✨

okay so this memo sets up a brand new connection security model for Message Transfer Agents (MTAs) 💌 The reason it needs to exist: inter-domain SMTP delivery picks the destination server indirectly through DNS Mail Exchange (MX) records, and neither email addresses nor MX hostnames tell you whether you need secure or cleartext transport. so, aside from a few manually configured exceptions, SMTP transport security is by necessity opportunistic (for a definition of "Opportunistic Security", see [RFC7435]) 🫶

this spec uses the presence of DANE TLSA records to securely signal TLS support, and to publish the means by which SMTP clients can successfully authenticate legit SMTP servers. this becomes "opportunistic DANE TLS", and it's resistant to downgrade and man-in-the-middle (MITM) attacks 🛡️ It enables an incremental transition of the email backbone to authenticated TLS delivery, and the global protection goes up as adoption does 📈

with opportunistic DANE TLS, traffic from SMTP clients to domains that publish "usable" DANE TLSA records in accordance with this memo gets authenticated and encrypted 🔐 Traffic from legacy clients, or going to domains that don't publish TLSA records, keeps getting sent the same way as before. that means manually configured security, (pre-DANE) opportunistic TLS, or just cleartext SMTP 🌸

the problems with the current use of TLS in MTA-to-MTA SMTP that motivate this spec are covered in Section 1.3. the spec itself follows in Sections 2 and 3, which explain, respectively, how to locate and use DANE TLSA records with SMTP 🧚 In Section 6 we talk about applying DANE TLS to destinations where channel integrity and confidentiality are mandatory. In Section 7 we briefly comment on how this spec might apply to Message User Agents 👑

1.1. Terminology 💅

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀

these are the terms and concepts used throughout this doc, bestie 🦋

  • Man-in-the-middle (MITM) attack: Active modification of network traffic by an adversary who is able to compromise the confidentiality or integrity of the data 😭
  • Downgrade attack: (From [RFC4949].) A type of MITM attack where the attacker can make two parties, while they negotiate a security association, agree on a lower level of protection than the highest level both of them could have supported 📉
  • Downgrade-resistant: A protocol is "downgrade-resistant" if it uses effective countermeasures against downgrade attacks 🛡️
  • "Secure", "bogus", "insecure", "indeterminate": DNSSEC validation results, as defined in Section 4.3 of [RFC4035] 🧠
  • Validating security-aware stub resolver and non-validating security-aware stub resolver: Capabilities of the stub resolver in use, as defined in [RFC4033]. Note that this spec requires the use of a security-aware stub resolver 🔍
  • (Pre-DANE) opportunistic TLS: Best-effort use of TLS that is generally vulnerable to DNS forgery and STARTTLS downgrade attacks. When a TLS-encrypted communication channel isn't available, the message is sent in the clear. MX record indirection generally rules out authentication even when TLS is available 🙈
  • Opportunistic DANE TLS: Best-effort use of TLS that's resistant to downgrade attacks for destinations with DNSSEC-validated TLSA records. When opportunistic DANE TLS is determined to be unavailable, clients should fall back to pre-DANE opportunistic TLS. Opportunistic DANE TLS requires support for DNSSEC, DANE, and STARTTLS on the client side, and STARTTLS plus a DNSSEC published TLSA record on the server side 💖
  • Reference identifier: (Special case of [RFC6125] definition.) One of the domain names the SMTP client associates with the destination SMTP server for doing name checks on the server certificate. When name checks apply, at least one of the reference identifiers MUST match an [RFC6125] DNS-ID (or, if none are present, the [RFC6125] CN-ID) of the server certificate (see Section 3.2.3) 🔖
  • MX hostname: The RRDATA of an MX record is a 16 bit preference followed by a Mail Exchange domain name (see [RFC1035], Section 3.3.9). We'll use the term "MX hostname" for the latter, meaning the DNS domain name after the preference value in an MX record. So an "MX hostname" is specifically a reference to a DNS domain name, not to any host that bears that name 🏷️
  • Delayed delivery: Email delivery is a multi-hop store-and-forward process. When an MTA can't forward a message that may become deliverable later, the message gets queued and delivery is retried periodically. Some MTAs may be configured with a fallback next-hop destination that handles messages the MTA would otherwise queue and retry. When a fallback next-hop destination is configured, messages that would otherwise have to be delayed may be sent to that fallback instead. The fallback destination may itself be subject to opportunistic or mandatory DANE TLS (Section 6) as though it were the original message destination ⏳
  • Original next-hop destination: The logical destination for mail delivery. By default this is the domain portion of the recipient address, but MTAs may be configured to forward mail for some or all recipients via designated relays. The original next-hop destination is either the recipient domain or the associated configured relay, respectively 📦
  • MTA: Message Transfer Agent ([RFC5598], Section 4.3.2) 📮
  • MSA: Message Submission Agent ([RFC5598], Section 4.3.1) 📨
  • MUA: Message User Agent ([RFC5598], Section 4.2.1) 📱
  • RR: A DNS resource record as defined in [RFC1034], Section 3.6 🧾
  • RRset: An RRset ([RFC2181], Section 5) is a group of DNS resource records that share the same label, class, and type 🍓

that's the first chunk, bestie! 💜 more parts are coming, so stay tuned 🦋

1.2. Background 🌸

okay so DNSSEC adds data origin authentication, data integrity, and data nonexistence proofs to the Domain Name System (DNS) 🔐. It's defined in [RFC4033], [RFC4034], and [RFC4035]. 💖

As described in the intro of [RFC6698], TLS authentication through the existing public Certification Authority (CA) PKI has a major overabundance problem: way too many trusted parties can issue certificates for any domain they want 🙃. DANE fixes this by using the DNSSEC infrastructure to publish public keys and certificates for the Transport Layer Security (TLS) [RFC5246] protocol, via the "TLSA" DNS record type 💜. With DNSSEC, each domain can only vouch for the keys of its delegated sub-domains. That's the whole vibe: you only get to speak for your own territory 👑.

The TLS protocol enables secure TCP communication. In this memo, channel security is assumed to be provided by TLS ✨. Used without authentication, TLS provides only privacy protection against eavesdropping attacks 🙈. Otherwise, TLS also provides data origin authentication to guard against MITM attacks 🛡️.

1.3. SMTP Channel Security 📬

With HTTPS, TLS employs X.509 certificates [RFC5280] issued by one of the many CAs bundled with popular web browsers, so users can authenticate their "secure" websites 🌐. Before we specify a new DANE TLS security model for SMTP, we're going to explain why a new security model is needed 🧠. In the process, we'll explain why the familiar HTTPS security model is inadequate to protect inter-domain SMTP traffic. Spoiler: it's not giving enough protection 💀.

The subsections below outline four key problems with applying traditional Web PKI [RFC7435] to SMTP. These problems are addressed by this specification 🎀. Since an SMTP channel security policy is not explicitly specified in either the recipient address or the MX record, a new signaling mechanism is required to indicate when channel security is possible and should be used. Publishing TLSA records lets server operators securely signal to SMTP clients that TLS is available and should be used 🫶. DANE TLSA makes it possible to simultaneously discover which destination domains support secure delivery via TLS and how to verify the authenticity of the associated SMTP services. That's a path forward to ubiquitous SMTP channel security, and I'm obsessed 😭🔥.

1.3.1. STARTTLS Downgrade Attack 🕵️

SMTP [RFC5321] is a single-hop protocol in a multi-hop store-and-forward email delivery process 📦. An SMTP envelope recipient address does not correspond to a specific transport-layer endpoint address. Instead, at each relay hop, the transport-layer endpoint is the next-hop relay, while the envelope recipient address typically stays the same 🔁. Unlike HTTP and its secured version, HTTPS, where the use of TLS is signaled via the URI scheme, email recipient addresses do not directly signal transport security policy. Indeed, no such signaling could work well with SMTP. TLS encryption of SMTP protects email traffic on a hop-by-hop basis, while email addresses could only express end-to-end policy. Not compatible, bestie 🙅‍♀️.

With no mechanism available to signal transport security policy, SMTP relays use a best-effort "opportunistic" security model for TLS 🎲. A single SMTP server TCP listening endpoint can serve both TLS and non-TLS clients, and TLS use is negotiated via the SMTP STARTTLS command [RFC3207]. The server signals TLS support to the client over a cleartext SMTP connection. If the client also supports TLS, it may negotiate a TLS-encrypted channel to use for email transmission 🔐. The server's indication of TLS support can be easily suppressed by an MITM attacker 😈. Thus, pre-DANE SMTP TLS security can be subverted by simply downgrading a connection to cleartext. No TLS security feature can prevent this. The attacker can simply disable TLS. Yikes 😱.

1.3.2. Insecure Server Name without DNSSEC 🔓

With SMTP, DNS MX records abstract the next-hop transport endpoint. They let administrators specify a set of target servers to which SMTP traffic should be directed for a given domain 📮.

A TLS client is vulnerable to MITM attacks unless it verifies that the server's certificate binds the public key to a name that matches one of the client's reference identifiers 🧐. A natural choice of reference identifier is the server's domain name. However, with SMTP, server names are not directly encoded in the recipient address. Instead, they're obtained indirectly via MX records. Without DNSSEC, the MX lookup is vulnerable to MITM and DNS cache poisoning attacks. Active attackers can forge DNS replies with fake MX records and redirect email to servers with names of their choice 🫠. Therefore, secure verification of SMTP TLS certificates matching the server name is not possible without DNSSEC. Main character villain arc 🦹‍♀️.

One might try to harden TLS for SMTP against DNS attacks by using the envelope recipient domain as a reference identifier. The idea is to require each SMTP server to possess a trusted certificate for the envelope recipient domain rather than the MX hostname 💭. Unfortunately, this is impractical. Email for many domains is handled by third parties that are not in a position to obtain certificates for all the domains they serve 😩. Deployment of the Server Name Indication (SNI) extension to TLS (see Section 3 of [RFC6066]) is no panacea. SNI key management is operationally challenging, except when the email service provider is also the domain's registrar and its certificate issuer, and this is rarely the case for email 🙃.

Since the recipient domain name cannot be used as the SMTP server reference identifier, and neither can the MX hostname without DNSSEC, large-scale deployment of authenticated TLS for SMTP requires that the DNS be secure 🔑.

Since SMTP security depends critically on DNSSEC, it's important to point out that SMTP with DANE is consequently the most conservative possible trust model 🧘‍♀️. It trusts only what must be trusted and no more. Adding any other trusted actors to the mix can only reduce SMTP security. A sender may choose to further harden DNSSEC for selected high-value receiving domains by configuring explicit trust anchors for those domains, instead of relying on the chain of trust from the root domain 💎. However, detailed discussion of DNSSEC security practices is out of scope for this document 🙊.

1.3.3. Sender Policy Does Not Scale 📉

Sending systems are in some cases explicitly configured to use TLS for mail sent to selected peer domains. But this requires configuring sending MTAs with appropriate subject names or certificate content digests from their peer domains 🥱. Due to the resulting administrative burden, such statically configured SMTP secure channels are used rarely. Generally, they're only used between domains that make bilateral arrangements with their business partners 🤝. Internet email, on the other hand, requires regularly contacting new domains for which security configurations cannot be established in advance 🌍. Not realistic, babe.

The abstraction of the SMTP transport endpoint via DNS MX records, often across organizational boundaries, limits the use of public CA PKI with SMTP to a small set of sender-configured peer domains 🚧. With little opportunity to use TLS authentication, sending MTAs are rarely configured with a comprehensive list of trusted CAs. SMTP services that support STARTTLS often deploy X.509 certificates that are self-signed or issued by a private CA 🫣.

1.3.4. Too Many Certification Authorities 🏛️

Even if it were generally possible to determine a secure server name, the SMTP client would still need to verify that the server's certificate chain is issued by a trusted CA (a trust anchor) 🪪. MTAs aren't interactive applications where a human operator can make a decision (wisely or otherwise) to selectively disable TLS security policy when certificate chain verification fails. With no user to "click OK", the MTA's list of public CA trust anchors would need to be comprehensive in order to avoid bouncing mail addressed to sites that employ unknown CAs 🙅‍♀️.

On the other hand, each trusted CA can issue certificates for any domain. If even one of the configured CAs is compromised or operated by an adversary, it can subvert TLS security for all destinations. 😭 Any set of CAs is simultaneously both overly inclusive and not inclusive enough. Literally a lose-lose 💅.

2. Identifying Applicable TLSA Records ✨

2.1. DNS Considerations 🧚

2.1.1. DNS Errors, "Bogus" Responses, and "Indeterminate" Responses 💅

Okay bestie, an SMTP client doing opportunistic DANE TLS 🔐 really depends on DNSSEC lookups being legit, like we covered in Section 1.3.2. So this section lists the DNS resolver requirements you need to avoid downgrade attacks 🙈

A DNS lookup can either signal an error or give you a definitive answer 🎀. For this spec, a security-aware resolver MUST be used ✨. Security-aware resolvers label the security status of a DNS RRset with one of four values from Section 4.3 of [RFC4035]: "secure", "insecure", "bogus", and "indeterminate". In [RFC4035], "indeterminate" means:

An RRset for which the resolver is not able to determine whether the RRset should be signed, as the resolver is not able to obtain the necessary DNSSEC RRs. This can occur when the security-aware resolver is not able to contact security-aware name servers for the relevant zones.

Now, "indeterminate" has a conflicting definition in Section 5 of [RFC4033] 🙃:

There is no trust anchor that would indicate that a specific portion of the tree is secure.

In this document, "indeterminate" is used exclusively in the [RFC4035] sense 💜. So getting an "indeterminate" result is a (transient) failure, basically the inability to locate the relevant DNS records. Anything that would be "indeterminate" in the [RFC4035] sense just gets classified as "insecure" 🌸.

We don't need to tell apart zones that lack a suitable ancestor trust anchor from delegations (ultimately) from a trust anchor that mark a child zone as "insecure". All "insecure" RRsets MUST be handled identically 🫶: either way, non-validated data for the query domain is all that is and can be available, and authentication using that data is impossible. The DNS root zone is signed now, so we expect validating resolvers on Internet-facing MTAs to be configured with root zone trust anchor data, which means domains with no ancestor trust anchor won't be possible in most deployments 🌈.

As Section 4.3 of [RFC4035] notes, a security-aware DNS resolver MUST be able to determine whether a given non-error DNS response is "secure", "insecure", "bogus", or "indeterminate" ✨. Most security-aware stub resolvers aren't expected to signal "indeterminate" (in the [RFC4035] sense) to the application. They'll usually signal a "bogus" or error result instead 💀. If a resolver does signal an [RFC4035] "indeterminate" status, the SMTP client MUST treat it as though a "bogus" or error result had been returned 🙅‍♀️.

An MTA using a non-validating security-aware stub resolver MAY use that stub resolver's ability (if it has one) to signal DNSSEC validation status, based on what the stub resolver learned from an upstream validating recursive resolver 🧚. Security-oblivious stub resolvers [RFC4033] MUST NOT be used 🚫. And per Section 4.9.3 of [RFC4035]:

... a security-aware stub resolver MUST NOT place any reliance on signature validation allegedly performed on its behalf, except when the security-aware stub resolver obtained the data in question from a trusted security-aware recursive name server via a secure channel.

To avoid repeating ourselves a ton below, let's pause and explain how "bogus" and "indeterminate" DNSSEC responses are handled 🍓. These aren't necessarily a malicious actor, either! They can happen when network packets get corrupted or lost in transit 😭. So in this memo, "bogus" or "indeterminate" replies are treated as a lookup failure ✨.

There's one non-failure case to highlight too 👑. Obviously, getting a non-empty "secure" or "insecure" RRset of the requested type is a success. But it's not an error when "secure" or "insecure" nonexistence is determined for the requested data 💖. If a DNSSEC response with a "secure" or "insecure" status says there are no records of the requested type, or that the query domain doesn't exist, that's not a DNS error. The client wasn't left hanging, it just learned that those records don't exist 🦋.

Security-aware stub resolvers will also signal DNS lookup errors in other cases, like when they get a "SERVFAIL" [RFC2136] response code (RCODE) [RFC1035], which won't have a DNSSEC status attached 🙈. Every lookup error is handled the same way in this spec, whether it's from a "bogus" or "indeterminate" DNSSEC status or a more generic DNS error 💅. The point is: the requested info can't be obtained by the security-aware resolver right now. So a lookup error is either a failure to get the relevant RRset if it exists, or a failure to determine that no such RRset exists when it doesn't 😵‍💫.

Compare that to a "bogus" or "indeterminate" response, where an "insecure" DNSSEC response is not an error 💜. As explained above, it means the target DNS zone is either delegated as an "insecure" child of a "secure" parent zone, or isn't a descendant of any DNSSEC trust anchors the SMTP client is using. "Insecure" results leave the SMTP client with degraded channel security, but they don't block message delivery 🌷. See Section 2.2 for the details.

2.1.2. DNS Error Handling 🚧

When a DNS lookup failure (an error, "bogus", or "indeterminate", as defined above) stops an SMTP client from figuring out which SMTP server or servers to connect to, message delivery MUST be delayed 🫠. That includes, for example, a "bogus" or "indeterminate" response during MX resolution. But if you got several MX hostnames from a successful MX lookup, and a later DNS lookup failure stops network address resolution for one of them, delivery may still go through any remaining MX hosts 🎀.

When a particular SMTP server is securely identified as the delivery destination, a set of DNS lookups (Section 2.2) MUST be performed to find any related TLSA records 🔍. If any DNS queries used to locate TLSA records fail (because of "bogus" or "indeterminate" records, timeouts, malformed replies, SERVFAIL responses, etc.), then the SMTP client MUST treat that server as unreachable and MUST NOT deliver the message via that server 🚫. If no servers are reachable, delivery is delayed ⏳.

Heads up: in the text that follows, we'll only describe what happens when all relevant DNS queries succeed 🙌. If any DNS failure happens, the SMTP client MUST behave as described in this section, by "skipping" the SMTP server or destination that's giving trouble 💀. TLSA record lookups count as "all relevant DNS queries", so SMTP clients MUST NOT keep connecting to an SMTP server or destination whose TLSA record lookup fails ✨.

2.1.3. Stub Resolver Considerations 🧩

Quick DNAME aliases moment 💅: a query for a domain name whose ancestor domain is a DNAME alias gets back the DNAME RR for that ancestor, plus a CNAME that maps the query domain to the matching subdomain of the DNAME alias's target domain [RFC6672]. So whenever we talk about CNAME aliases, we're implicitly including aliases that come from an ancestor's DNAME record 🦋. That means SMTP software doesn't need explicit DNAME support. Processing the resulting CNAME aliases is enough 🌸. DNAME records only need special handling in the validating stub resolver library that checks the integrity of the combined DNAME + CNAME reply. And if a local caching resolver does DNSSEC validation instead of the MTA itself, even that part is outside the MTA 🙌.

When a stub resolver returns a CNAME alias that doesn't also include the query results for the alias target, the SMTP client will need to repeat the query at the target. It should do so recursively, up to some configured or implementation-dependent recursion limit 🔁. If an error shows up at any stage of CNAME expansion, the lookup of the original requested records MUST be considered to have failed ❌.

Whether a chain of CNAME records came back in one stub resolver response or through explicit recursion by the SMTP client, if an "insecure" CNAME record turns up at any stage, then it and all subsequent results (in particular, the final result) MUST be considered "insecure" 🙅‍♀️. That's true no matter whether the earlier CNAMEs leading to it were "secure" 💜.

Also, a security-aware non-validating stub resolver may pass along an "insecure" reply from a validating recursive resolver 🧐. That reply might contain a CNAME plus additional answers recursively obtained from the CNAME's target. The only conclusion you can draw is that some record in that set is "insecure". It's entirely possible that the initial CNAME and some of the later records are "secure" 🤷‍♀️.

If the SMTP client needs to know the security status of the DNS zone that holds the initial CNAME record, it'll need to issue a separate query of type "CNAME" that returns only that initial CNAME record 🔎. Specifically, as discussed in Section 2.2.2, when "insecure" A or AAAA records are found for an SMTP server via a CNAME alias, the SMTP client will need to do an additional CNAME query. That tells it whether the DNS zone where the alias is published is DNSSEC signed 🔐✨.

2.2. TLS Discovery ✨

Okay so, remember Section 1.3.1? That's where we covered the STARTTLS downgrade attack. Opportunistic TLS with SMTP servers that advertise STARTTLS can be targeted by a MITM who strips the offer 👀. Some SMTP servers that aren't actually TLS capable also advertise STARTTLS by default 🙃, so clients have to be ready to retry in cleartext when STARTTLS fails. The vibe flips for DNSSEC-validated TLSA records, though. They MUST NOT be published for servers that don't support TLS. So if you spot one, you can safely read it as the operator making a promise: "yep, we do TLS and STARTTLS" 💖

This memo defines four actions to take after the TLSA search comes back with "secure" usable results, "secure" unusable results, "insecure" or no results, or an error signal 🦋. "Usable" here means what it means in Section 4.1 of [RFC6698]. So if the DNS lookup for a TLSA record returns:

  • A "secure" TLSA RRset with at least one usable record: Any connection to the MTA MUST employ TLS encryption and MUST authenticate the SMTP server using the techniques discussed in the rest of this document. Failure to establish an authenticated TLS connection MUST result in falling back to the next SMTP server or delayed delivery. 🔒
  • A "secure" non-empty TLSA RRset where all the records are unusable: Any connection to the MTA MUST be made via TLS, but authentication is not required. Failure to establish an encrypted TLS connection MUST result in falling back to the next SMTP server or delayed delivery. 🌸
  • An "insecure" TLSA RRset or DNSSEC-authenticated denial of existence of the TLSA records: A connection to the MTA SHOULD be made using (pre-DANE) opportunistic TLS. That includes cleartext delivery when the remote SMTP server doesn't appear to support TLS. The MTA MAY retry in cleartext when delivery via TLS fails during the handshake or even during data transfer. 🧚
  • Any lookup error: Lookup errors, including "bogus" and "indeterminate" as explained in Section 2.1.1, MUST result in falling back to the next SMTP server or delayed delivery. 🚨

An SMTP client MAY be configured to mandate DANE-verified delivery for some destinations. With mandatory DANE TLS (Section 6), delivery only goes ahead when "secure" TLSA records are used to set up an encrypted and authenticated TLS channel with the SMTP server. Main character energy for sure 👑

When the original next-hop destination is an address literal rather than a DNS domain, DANE TLS doesn't apply. Delivery goes ahead using whatever security policy the MTA administrator has configured. Same deal when an MX RRset incorrectly lists a network address instead of an MX hostname. If an MTA chooses to connect to the network address in that nonconformant MX record, DANE TLSA doesn't apply to that connection 🙈

In the subsections that follow, we'll look at how to find the SMTP servers and their associated TLSA records for a given next-hop destination domain. We'll also cover which name or names get used in identity checks of the SMTP server certificate. Let's gooo 🎀

2.2.1. MX Resolution 📬

Okay, this part is about next-hop domains that go through MX resolution and actually have MX records. The TLSA records and the associated base domain get derived separately for each MX hostname used to attempt delivery. DANE TLS can only authenticate delivery to the intended next-hop domain when the MX records were obtained securely through a DNSSEC-validated lookup. No shortcuts, bestie 🔥

MX records MUST be sorted by preference. An MX hostname with a worse (numerically higher) MX preference that has TLSA records MUST NOT preempt an MX hostname with a better (numerically lower) preference that has no TLSA records. In other words, preventing delivery loops by obeying MX preferences MUST take precedence over channel security considerations. Even with two equal-preference MX records, an MTA isn't obligated to pick the MX hostname that offers more security. So if a domain wants secure inbound mail, it needs to make sure all its SMTP servers and MX records are set up accordingly 💅

In the language of [RFC5321], Section 5.1, the original next-hop domain is the "initial name". If the MX lookup of the initial name results in a CNAME alias, the MTA replaces the initial name with the resulting name and does a new lookup with that new name. MTAs typically support recursion in CNAME expansion, so this replacement happens repeatedly (up to the MTA's recursion limit) until the ultimate non-CNAME domain is found. It's giving treasure hunt 🗺️✨

If the MX RRset (or any CNAME leading to it) is "insecure" (see Section 2.1.1) and DANE TLS for the given destination is mandatory (Section 6), delivery MUST be delayed. If the MX RRset is "insecure" and DANE TLS isn't mandatory, the SMTP client is free to use pre-DANE opportunistic TLS, possibly even cleartext 🫶

Since the protocol in this memo is an Opportunistic Security protocol [RFC7435], the SMTP client MAY elect to use DANE TLS (as described in Section 2.2.2 below), even with MX hosts obtained via an "insecure" MX RRset. For example, when a hosting provider has a signed DNS zone and publishes TLSA records for its SMTP servers, hosted domains that aren't signed may still benefit from the provider's TLSA records. Deliveries via the provider's SMTP servers won't be subject to active attacks when sending SMTP clients elect to use the provider's TLSA records. Active attacks that tamper with the "insecure" MX RRset are still possible in this case, obviously 🙃

When the MX records aren't (DNSSEC) signed, an active attacker can redirect SMTP clients to MX hosts of their choice 😱. That redirection is tamper-evident when SMTP servers found via "insecure" MX records get recorded as the next-hop relay in the MTA delivery logs in their original (rather than CNAME-expanded) form. So sending MTAs SHOULD log unexpanded MX hostnames when these result from "insecure" MX lookups. And any successful authentication via an insecurely determined MX host MUST NOT be misrepresented in the mail logs as secure delivery to the intended next-hop domain. Honesty in the logs, always 📝

In the absence of DNS lookup errors (Section 2.1.1), if the MX RRset isn't "insecure", then it's "secure", and the SMTP client MUST treat each MX hostname as described in Section 2.2.2. When no TLSA records are found for a given MX hostname, or only "insecure" TLSA records are found, DANE TLSA isn't applicable with that SMTP server, and delivery proceeds to that host just like pre-DANE opportunistic TLS. To avoid downgrade attacks, any errors during TLSA lookups MUST, as explained in Section 2.1.2, cause the SMTP server in question to be treated as unreachable. No downgrade slander allowed 🚫💀

2.2.2. Non-MX Destinations ✨

okay so this section is about how we find the TLSA records and the TLSA base domain for destinations that DON'T go through MX lookup, or that are a hostname from a "secure" MX RRset, or that just don't have MX records at all 🧚 these are the cases it covers:

  • Any host the sending MTA admin has configured as the next-hop relay for some or all domains, as long as it isn't subject to MX resolution. 💌
  • A domain that has MX records. We treat each MX host listed there as if it were a non-MX destination, which means the same way we'd treat an admin-configured relay handling that domain. (Unlike admin-specified relays, MTAs are not required to support CNAME expansion of next-hop names found via MX lookups. 🙈)
  • A next-hop destination domain that is subject to MX resolution but has no MX records. In that case the domain's name is also its one and only SMTP server name, implicitly. 🍓

Now the drama 💀 Some big email providers use load-balancing nameservers to serve their MX hostnames, and those nameservers mishandle DNS queries with type TLSA. The zones they serve aren't signed and contain no TLSA records, and these nameservers SHOULD give "insecure" negative replies saying the TLSA records don't exist. Instead, they either don't respond at all, or they send back a DNS RCODE [RFC1035] other than NXDOMAIN, like SERVFAIL or NOTIMP [RFC2136]. Honestly, rude. 😭

So to avoid delivery problems for domains whose SMTP servers sit behind these nameservers, the SMTP client MUST perform any A and/or AAAA queries for the destination before it tries to locate the TLSA records. We need that lookup anyway to figure out (1) whether the destination domain is reachable at all and (2) the DNSSEC validation status of the chain of CNAME queries needed to reach the final address records. Main character sequencing 💅

If no address records come back, the destination is unreachable. If address records DO come back but the DNSSEC validation status of the first query response is "insecure" (see Section 2.1.3), the SMTP client SHOULD NOT go searching for any associated TLSA records. For these problematic domains, TLSA queries would just cause DNS lookup errors, which means messages keep getting delayed and eventually bounced back to the sender. We don't expect to find any "secure" TLSA records tied to a TLSA base domain sitting in an unsigned DNS zone, so skipping the TLSA lookups here cuts down on latency with no hit to security. Win-win, bestie 🎀

If the A and/or AAAA lookup of the initial name returns a CNAME, we swap in the resulting name as if it were the initial name and do the lookup again with the new one. This swap happens recursively, up to the MTA's recursion limit. 🦋

Here's how we handle a DNS response for an A or AAAA lookup:

Not found: When the DNS queries for A and/or AAAA records give back neither a list of addresses nor a CNAME (or CNAME expansion isn't supported), the destination is unreachable. 🥀

Non-CNAME: The answer is not a CNAME alias. If the address RRset is "secure", TLSA lookups are performed as described in Section 2.2.3, with the initial name as the candidate TLSA base domain. If no "secure" TLSA records are found, DANE TLS doesn't apply, and mail delivery moves on to pre-DANE opportunistic TLS. That one is best-effort, so it degrades to cleartext delivery when STARTTLS isn't available or the TLS handshake fails. 🌸

Insecure CNAME: The input domain is a CNAME alias, but the ultimate network address RRset is "insecure" (see Section 2.1.1). If the initial CNAME response is also "insecure", DANE TLS doesn't apply. Otherwise, this case gets treated just like the non-CNAME case above, where we search for a TLSA record using the original input domain as the candidate TLSA base domain. 🔍

Secure CNAME: The input domain is a CNAME alias, and the ultimate network address RRset is "secure" (see Section 2.1.1). Two candidate TLSA base domains get tried: the fully CNAME-expanded initial name first and, if that fails, the initial name itself. 👑

The big picture, summarised 💜 If we can securely get the full, CNAME-expanded, DNSSEC-validated address records for the input domain, then that expanded name is the preferred TLSA base domain. Otherwise, the unexpanded input domain is the candidate TLSA base domain. If no "secure" TLSA records turn up at either the CNAME-expanded or the unexpanded domain, then DANE TLS doesn't apply for mail delivery via that input domain. And as always, errors, "bogus" results, or "indeterminate" results for any query in the process MUST result in delaying or abandoning delivery. No exceptions, periodt 🛑

2.2.3. TLSA Record Lookup 🧚‍♀️

When the SMTP server's hostname is not a CNAME or DNAME alias, the list of candidate TLSA base domains (more on that below) is just the server hostname. Easy. 🌈

When the hostname IS an alias with a "secure" (at every stage) full expansion, the list of candidate TLSA base domains becomes a pair: the fully expanded server hostname first, then the unexpanded server hostname second. 🫶

Each candidate TLSA base domain (alias-expanded or original) gets prefixed in turn with service labels of the form "_<port>._tcp". The resulting domain name is then used to issue a DNSSEC query with the query type set to TLSA ([RFC6698], Section 7.1). ✨

The first of these candidate domains to yield a "secure" TLSA RRset becomes the actual TLSA base domain. 💖

For SMTP, the destination TCP port is typically 25. It can be different with custom routes specified by the MTA administrator, though, and in that case the SMTP client MUST use the appropriate number in the "_<port>" prefix in place of "_25". For example, if the candidate base domain is "mx.example.com" and the SMTP connection is to port 25, the TLSA RRset is obtained via a DNSSEC query of this form:

_25._tcp.mx.example.com. IN TLSA ?

The query response may be a CNAME or the actual TLSA RRset. If it's a CNAME, the SMTP client (through its security-aware stub resolver) restarts the TLSA query at the target domain, following CNAMEs as appropriate, and keeps track of whether the entire chain is "secure". If any "insecure" records are encountered, or the TLSA records don't exist, the next candidate TLSA base domain gets tried instead. 🔄

If the ultimate response is a "secure" TLSA RRset, then the candidate TLSA base domain becomes the actual TLSA base domain, and that TLSA RRset constitutes the TLSA records for the destination. If none of the candidate TLSA base domains yield "secure" TLSA records, the SMTP client is free to use pre-DANE opportunistic TLS (possibly even cleartext). 🙃

TLSA record publishers can use CNAMEs to point at a single authoritative TLSA RRset that specifies a common CA or a common end-entity certificate, to be used with multiple TLS services. That CNAME expansion does NOT change the SMTP client's notion of the TLSA base domain. So when _25._tcp.mx.example.com is a CNAME, the base domain stays mx.example.com, and that's still the reference identifier used together with the next-hop domain in peer certificate name checks. 🎀

Now a warning, bestie 💀 Shared end-entity certificate associations expose the publishing domain to substitution attacks, where a MITM attacker reroutes traffic to a different server that shares the same end-entity certificate. Such shared end-entity TLSA records SHOULD be avoided, unless the servers in question are functionally equivalent or use mutually incompatible protocols. (An active attacker gains nothing by diverting client traffic from one such server to another, so that's the exception that makes sense 🧠)

⚠️ Shared end-entity TLSA records SHOULD be avoided, as noted above, unless the servers are functionally equivalent or use mutually incompatible protocols.

A much better example uses a shared trust anchor instead of shared end-entity certificates. Here are the DNSSEC-validated records:

example.com.                IN MX 0 mx1.example.com.
example.com.                IN MX 0 mx2.example.com.
_25._tcp.mx1.example.com.   IN CNAME tlsa201._dane.example.com.
_25._tcp.mx2.example.com.   IN CNAME tlsa201._dane.example.com.
tlsa201._dane.example.com.  IN TLSA 2 0 1 e3b0c44298fc1c149a...

The SMTP servers mx1.example.com and mx2.example.com are expected to have certificates issued under a common trust anchor. Each MX hostname's TLSA base domain stays unchanged despite those CNAME records. So each SMTP server gets associated with a pair of reference identifiers: its own hostname plus the next-hop domain "example.com". Clean, iconic, no notes 🦋

If, during TLSA resolution (including any CNAME indirection), at least one "secure" TLSA record is found, even if it's not usable because the implementation doesn't support it or support is administratively disabled, then the corresponding host has signaled its commitment to implement TLS. The SMTP client MUST NOT deliver mail via that host unless a TLS session is negotiated via STARTTLS. This is required to avoid MITM STARTTLS downgrade attacks. Not on my watch 🛡️

As noted previously (in Section 2.2.2), when no "secure" TLSA records are found at the fully CNAME-expanded name, the original unexpanded name MUST be tried instead. This supports customers of hosting providers where the provider's zone can't be validated with DNSSEC, but the customer has shared the appropriate key material with the hosting provider to enable TLS via SNI. Intermediate names that show up during CNAME expansion (neither the original name nor the final name) are never candidate TLSA base domains, even if they're "secure". Those are off limits, bestie 🚫

3. DANE Authentication 🔐

This section describes which TLSA records are applicable to SMTP opportunistic DANE TLS, and how to apply those records to authenticate the SMTP server. With opportunistic DANE TLS, both the TLS support implied by the presence of DANE TLSA records and the verification parameters needed to authenticate the TLS peer are obtained together. 🫧 Unlike protocols where the client alone sets the channel security policy, authentication via this protocol is expected to be less prone to connection failure caused by incompatible configuration of the client and server. Teamwork makes the dream work 💕

3.1. TLSA Certificate Usages 🎀

okay so the DANE TLSA spec [RFC6698] defines a bunch of TLSA RR types by mixing three numeric parameters together 🔢. Those numbers got symbolic names later in [RFC7218] 💅. The rest of the TLSA record is the "certificate association data field", which holds the full or digest value of a certificate or public key 🔐.

Since opportunistic DANE TLS is gonna be used by non-interactive MTAs, there's no human to "click OK" when auth fails 💀. So reliability of peer authentication is literally paramount 🫶. Server operators are advised to publish TLSA records that are least likely to fail authentication because of interop or operational problems. Because DANE TLS relies on coordinated changes to DNS and SMTP server settings, the best records to publish depend on site-specific practices 🌸.

The certificate usage element of a TLSA record is the main character when it comes to how the certificate association data field gets used to authenticate a server's certificate chain 👑. Sections 3.1.1 and 3.1.2 explain the process for certificate usages DANE-EE(3) and DANE-TA(2), respectively. Section 3.1.3 briefly explains why certificate usages PKIX-TA(0) and PKIX-EE(1) are not applicable with opportunistic DANE TLS 🙈.

In summary, we RECOMMEND the use of "DANE-EE(3) SPKI(1) SHA2-256(1)", with "DANE-TA(2) Cert(0) SHA2-256(1)" TLSA records as a second choice, depending on site needs 🍓. See Sections 3.1.1 and 3.1.2 for more details. Other combinations of TLSA parameters either (1) are explicitly unsupported or (2) offer little to recommend them over these two 💜.

3.1.1. Certificate Usage DANE-EE(3)

Authentication via certificate usage DANE-EE(3) TLSA records is giving simple vibes: you just check that the server's leaf certificate matches the TLSA record ✨. The binding of the server public key to its name is based entirely on the TLSA record association 🦋. The server MUST be considered authenticated even if none of the names in the certificate match the client's reference identity for the server. no cap, that's a big one 😭.

The expiration date of the server certificate MUST be ignored 🙈. The validity period of the TLSA record key binding is determined by the validity interval of the TLSA record DNSSEC signature 🔏.

With DANE-EE(3), servers don't need to employ SNI (they may ignore the client's SNI message) even when the server is known under independent names that would otherwise require separate certificates 🧚. It's instead sufficient for the TLSA RRsets for all the domains in question to match the server's default certificate. Of course, with SMTP servers it is simpler still to publish the same MX hostname for all the hosted domains 🍰.

For domains where it's practical to make coordinated changes in DNS TLSA records during SMTP server key rotation, it is often best to publish end-entity DANE-EE(3) certificate associations 🎀. DANE-EE(3) certificates don't suddenly stop working when leaf or intermediate certificates expire, nor do they fail when the server operator neglects to configure all the required issuer certificates in the server certificate chain. That's iconic behaviour 👑.

TLSA records published for SMTP servers SHOULD, in most cases, be "DANE-EE(3) SPKI(1) SHA2-256(1)" records 💖. Since all DANE implementations are required to support SHA2-256, this record type works for all clients and need not change across certificate renewals with the same key 🌈.

3.1.2. Certificate Usage DANE-TA(2)

Some domains may prefer to avoid the operational complexity of publishing unique TLSA RRs for each TLS service 🥱. If the domain employs a common issuing CA to create certificates for multiple TLS services, it may be simpler to publish the issuing authority as a trust anchor (TA) for the certificate chains of all relevant services 🌸. The TLSA query domain (TLSA base domain with port and protocol prefix labels) for each service issued by the same TA may then be set to a CNAME alias that points to a common TLSA RRset that matches the TA. For example:

example.com.                IN MX 0 mx1.example.com.
example.com.                IN MX 0 mx2.example.com.
_25._tcp.mx1.example.com.   IN CNAME tlsa201._dane.example.com.
_25._tcp.mx2.example.com.   IN CNAME tlsa201._dane.example.com.
tlsa201._dane.example.com.  IN TLSA 2 0 1 e3b0c44298fc1c14....

With usage DANE-TA(2), the server certificates will need to have names that match one of the client's reference identifiers (see [RFC6125]). The server MAY employ SNI to select the appropriate certificate to present to the client 🧠.

SMTP servers that rely on certificate usage DANE-TA(2) TLSA records for TLS authentication MUST include the TA certificate as part of the certificate chain presented in the TLS handshake server certificate message, even when it is a self-signed root certificate 📜. Many SMTP servers are not configured with a comprehensive list of trust anchors, nor are they expected to be at any point in the future 😬. Some MTAs will ignore all locally trusted certificates when processing usage DANE-TA(2) TLSA records. Thus, even when the TA happens to be a public CA known to the SMTP client, authentication is likely to fail unless the TA certificate is included in the TLS server certificate message 🙃.

With some SMTP server software, it is not possible to configure the server to include self-signed (root) CA certificates in the server certificate chain. Such servers either MUST publish DANE-TA(2) records for an intermediate certificate or MUST instead use DANE-EE(3) TLSA records 🫠.

TLSA records with a matching type of Full(0) are discouraged 🚫. While these potentially obviate the need to transmit the TA certificate in the TLS server certificate message, client implementations may not be able to augment the server certificate chain with the data obtained from DNS, especially when the TLSA record supplies a bare key (selector SPKI(1)). Since the server will need to transmit the TA certificate in any case, server operators SHOULD publish TLSA records with a matching type other than Full(0) and avoid potential interoperability issues with large TLSA records containing full certificates or keys 📦.

TLSA Publishers employing DANE-TA(2) records SHOULD publish records with a selector of Cert(0) 🎀. Such TLSA records are associated with the whole trust anchor certificate, not just with the trust anchor public key. In particular, the SMTP client SHOULD then apply any relevant constraints from the trust anchor certificate, such as, for example, path length constraints 🔍.

While a selector of SPKI(1) may also be employed, the resulting TLSA record will not specify the full trust anchor certificate content, and elements of the trust anchor certificate other than the public key become mutable. This may, for example, allow a subsidiary CA to issue a chain that violates the trust anchor's path length or name constraints 😱.

3.1.3. Certificate Usages PKIX-TA(0) and PKIX-EE(1)

Note that this section applies to MTA-to-MTA SMTP, which is normally on port 25 -- that is, to servers that are the SMTP servers for one or more destination domains 📬. Other uses of SMTP, such as in MUA-to-MSA submission on ports 587 or 465, are out of scope for this document. Where those other uses also employ TLS opportunistically and/or depend on DNSSEC as a result of DNS-based discovery of service location, the relevant specifications should, as appropriate, arrive at similar conclusions 🫶.

As noted in Sections 1.3.1 and 1.3.2, sending MTAs cannot, without relying on DNSSEC for "secure" MX records and DANE for STARTTLS support signaling, perform server identity verification or prevent STARTTLS downgrade attacks 🚨. The use of PKIX CAs offers no added security, since an attacker capable of compromising DNSSEC is free to replace any PKIX-TA(0) or PKIX-EE(1) TLSA records with records bearing any convenient non-PKIX certificate usage 😈. Finally, as explained in Section 1.3.4, there is no list of trusted CAs agreed upon by all MTAs and no user to "click OK" when a server's CA is not trusted by a client 🙈.

Therefore, TLSA records for the port 25 SMTP service used by client MTAs SHOULD NOT include TLSA RRs with certificate usage PKIX-TA(0) or PKIX-EE(1). SMTP client MTAs cannot be expected to be configured with a suitably complete set of trusted public CAs. Lacking a complete set of public CAs, MTA clients would not be able to verify the certificates of SMTP servers whose issuing root CAs are not trusted by the client 🥀.

Opportunistic DANE TLS needs to interoperate without bilateral coordination of security settings between client and server systems. Therefore, parameter choices that are fragile in the absence of bilateral coordination are unsupported. Nothing is lost; since the PKIX certificate usages cannot aid SMTP TLS security, they can only impede SMTP TLS interoperability 💅.

SMTP client treatment of TLSA RRs with certificate usages PKIX-TA(0) or PKIX-EE(1) is undefined. As with any other unsupported certificate usage, SMTP clients MAY treat such records as "unusable" 🗑️.

3.2. Certificate Matching 🦋

When at least one usable "secure" TLSA record is found, the SMTP client MUST use TLSA records to authenticate the SMTP server. Messages MUST NOT be delivered via the SMTP server if authentication fails; otherwise, the SMTP client is vulnerable to MITM attacks 🚨😭. This part is serious, bestie!

3.2.1. DANE-EE(3) Name Checks 🌟

The SMTP client MUST NOT perform certificate name checks with certificate usage DANE-EE(3) (Section 3.1.1) 🙅‍♀️. That's the whole point of DANE-EE(3) skipping the name match, so don't do it 💖.

3.2.2. DANE-TA(2) Name Checks

okay bestie, when a TLSA record uses certificate usage DANE-TA(2) 🦋, the client MUST perform name checks so it knows it actually reached the right server 💅. In every DANE-TA(2) case, the SMTP client MUST employ the TLSA base domain as the primary reference identifier for matching the server certificate ✨.

TLSA records for MX hostnames: If the TLSA base domain was found indirectly through a "secure" MX lookup (including any CNAME-expanded name of an MX hostname), then the original next-hop domain used in that MX lookup MUST be included as a second reference identifier 🌸. The CNAME-expanded original next-hop domain MUST be included as a third reference identifier if it's different from the original next-hop domain 🔥. When the client MTA is using DANE TLS security even though the MX redirection was "insecure," the MX hostname is the only reference identifier 🙈.

TLSA records for non-MX hostnames: If MX records weren't used (for example, because none exist) and the TLSA base domain is the CNAME-expanded original next-hop domain, then the original next-hop domain MUST be included as a second reference identifier 🧚.

Accepting certificates that carry the original next-hop domain alongside the MX hostname is seriously iconic 👑. It lets a domain with several MX hostnames show off a single certificate with one domain name (aka the email domain) across all of its SMTP servers 💖. It also keeps things working with pre-DANE SMTP clients that look for the email domain name in server certificates. For example, here's a setup with "secure" DNS records:

exchange.example.org.            IN CNAME mail.example.org.
mail.example.org.                IN CNAME example.com.
example.com.                     IN MX    10 mx10.example.com.
example.com.                     IN MX    15 mx15.example.com.
example.com.                     IN MX    20 mx20.example.com.
;
mx10.example.com.                IN A     192.0.2.10
_25._tcp.mx10.example.com.       IN TLSA  2 0 1 ...
;
mx15.example.com.                IN CNAME mxbackup.example.com.
mxbackup.example.com.            IN A     192.0.2.15
; _25._tcp.mxbackup.example.com. IN TLSA ? (NXDOMAIN)
_25._tcp.mx15.example.com.       IN TLSA  2 0 1 ...
;
mx20.example.com.                IN CNAME mxbackup.example.net.
mxbackup.example.net.            IN A     198.51.100.20
_25._tcp.mxbackup.example.net.   IN TLSA  2 0 1 ...

Certificate name checks for delivering mail to exchange.example.org through any of the associated SMTP servers MUST accept at least the names "exchange.example.org" and "example.com" 🎀. Those are, respectively, the original and fully expanded next-hop domain. When the SMTP server is mx10.example.com, name checks MUST accept the TLSA base domain "mx10.example.com" 💅. If, even though MX hostnames are required to not be aliases, the MTA supports delivery via "mx15.example.com" or "mx20.example.com," then name checks MUST accept the matching TLSA base domains "mx15.example.com" and "mxbackup.example.net" respectively 😭✨.

3.2.3. Reference Identifier Matching

When name checks apply (certificate usage DANE-TA(2)), here's the tea ☕: if the server certificate has a Subject Alternative Name extension [RFC5280] with at least one DNS-ID [RFC6125], then ONLY the DNS-IDs get matched against the client's reference identifiers 🦋. The CN-ID [RFC6125] only gets a look when there are no DNS-IDs at all. The server certificate counts as matched once one of its presented identifiers [RFC5280] matches any of the client's reference identifiers 🎉.

Wildcards are allowed in either DNS-IDs or the CN-ID, when applicable 🌈. The wildcard character must be the entire first label of the DNS-ID or CN-ID. So ".example.com" is valid, while "smtp.example.com" and "smtp.example.com" are not 🙅‍♀️. SMTP clients MUST support wildcards that match the first label of the reference identifier, with the remaining labels matching verbatim 💜. For example, the DNS-ID ".example.com" matches the reference identifier "mx1.example.com" ✨. SMTP clients MAY, subject to local policy, let wildcards match multiple reference identifier labels, but servers can't expect broad support for that policy 🫶. So any wildcards in server certificates SHOULD match exactly one label in either the TLSA base domain or the next-hop domain 🍓.

4. Server Key Management 🔑

Two TLSA records MUST be published before using a new EE or TA public key or certificate: one matching the currently deployed key, and one matching the new key that's scheduled to replace it 📝. Once enough time has passed for every DNS cache to expire the previous TLSA RRset and its related signature RRsets, servers may be configured to use the new EE private key and its associated public key certificate, or they may use certificates signed by the new trust anchor 🌸.

Once the new public key or certificate is in use, the TLSA RR that matches the retired key can be removed from DNS, leaving only RRs that match keys or certificates in active use 🧹.

As described in Section 3.1.2, when server certificates are validated via a DANE-TA(2) trust anchor and CNAME records are used to store the TA association data at a single location, the job of updating the TLSA RRset moves over to the operator of the trust anchor 👑. Before a new trust anchor is used to sign any new server certificates, its certificate (digest) gets added to the relevant TLSA RRset. After enough time passes for the original TLSA RRset to age out of DNS caches, the new trust anchor can start issuing new server certificates. Once every certificate issued under the previous trust anchor has expired, its associated RRs can be removed from the TLSA RRset 💅.

In the DANE-TA(2) key management model, server operators don't generally need to update DNS TLSA records after they've initially created a CNAME record that points to the centrally operated DANE-TA(2) RRset 🦋. If a particular server's key gets compromised, its TLSA CNAME SHOULD be replaced with a DANE-EE(3) association until the certificate for the compromised key expires. At that point it can go back to using a CNAME record 🔄. If the central trust anchor gets compromised, all servers need new keys issued by a new TA, and an updated DANE-TA(2) TLSA RRset needs to be published that contains just the new TA 😭.

SMTP servers can't expect broad Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) support from SMTP clients 💀. As outlined above, with DANE, compromised server or trust anchor keys can be "revoked" by removing them from the DNS, without needing client-side support for OCSP or CRLs 🫧.

5. Digest Algorithm Agility 🧁

While [RFC6698] specifies multiple digest algorithms, it doesn't specify a protocol that lets the SMTP client and the TLSA record publisher agree on the strongest shared algorithm 🤔. That kind of protocol would help the client and server avoid exposure to deprecated weaker algorithms that are published only for compatibility with less capable clients. When stronger algorithms are an option, deprecated algorithms SHOULD be avoided 🚫. That protocol is specified in [RFC7671]. SMTP clients and servers that implement this specification MUST comply with the requirements outlined in Section 9 of [RFC7671] 💜.

6. Mandatory TLS Security 🔐

An MTA implementing this protocol may require a stronger security assurance when sending email to selected destinations 📬. The sending organization may need to send sensitive email, and/or it may have regulatory obligations to protect its content. This protocol doesn't conflict with that requirement. In fact, it can often make authenticated delivery to those destinations way simpler ✨.

Specifically, with domains that publish DANE TLSA records for their MX hostnames, a sending MTA can be configured to use the receiving domain's DANE TLSA records to authenticate the matching SMTP server 🎀. Authentication via DANE TLSA records is easier to manage, because changes to the receiver's expected certificate properties are made on the receiving end and don't need manually communicated configuration changes 🥰. With mandatory DANE TLS, when no usable TLSA records are found, message delivery gets delayed. So mail only gets sent once an authenticated TLS channel to the remote SMTP server is established 🛡️.

Administrators of mail servers that use mandatory DANE TLS need to keep a close eye on their mail logs and queues 👀. If a partner domain unwittingly misconfigures its TLSA records, disables DNSSEC, or misconfigures its SMTP server certificate chains, mail will be delayed and may bounce if the issue isn't fixed in a timely manner 😭💔.

7. Note on DANE for Message User Agents 📮

We should note that SMTP is also used between Message User Agents (MUAs) and Message Submission Agents (MSAs) [RFC6409] 💌. In [RFC6186], a protocol is specified that lets an MUA dynamically locate the MSA based on the user's email address 🧭. SMTP connection security considerations for MUAs implementing [RFC6186] are largely analogous to the connection security requirements for MTAs. This specification could be applied largely verbatim, with DNS MX records replaced by corresponding DNS Service (SRV) records [RFC7673] 🪄.

However, until MUAs start adopting the dynamic configuration mechanisms of [RFC6186], they're adequately served by more traditional static TLS security policies 🌷. Specification of DANE TLS for MUA-to-MSA SMTP is left to future documents that focus specifically on SMTP security between MUAs and MSAs 📚.

8. Interoperability Considerations 🤝

8.1. SNI Support

To make sure the server sends the right certificate chain, the SMTP client MUST send the TLS SNI extension containing the TLSA base domain 🏷️. This rules out the use of the Secure Socket Layer (SSL) HELLO that is SSL 2.0 compatible by the SMTP client 🚫.

Each SMTP server MUST present a certificate chain (see [RFC5246], Section 7.4.2) that matches at least one of the TLSA records 🔒. The server MAY rely on SNI to decide which certificate chain to present to the client. Clients that don't send SNI information may not see the expected certificate chain 🙈.

If the server's TLSA records match the server's default certificate chain, the server doesn't need to support SNI 🌟. Either way, the server need not include the SNI extension in its TLS HELLO, because simply returning a matching certificate chain is enough ✅. Servers MUST NOT enforce the use of SNI by clients, since the client may be using unauthenticated opportunistic TLS and may not expect any particular certificate from the server 💅. If the client sends no SNI extension, or sends an SNI extension for an unsupported domain, the server MUST simply send some fallback certificate chain of its choice 🫶. The reason strict matching of the requested SNI hostname isn't enforced is that DANE TLS clients are typically willing to accept multiple server names but can only send one name in the SNI extension 🧠. The server's fallback certificate may match a different name that's acceptable to the client, e.g., the original next-hop domain 🦋.

8.2. Anonymous TLS Cipher Suites 🧚

okay so lots of SMTP servers either don't support anonymous TLS cipher suites or just never turn them on 💀, so SMTP client TLS HELLO messages SHOULD offer to negotiate a typical set of non-anonymous cipher suites required for interoperability with those servers. An SMTP client using pre-DANE opportunistic TLS MAY also throw one or more anonymous TLS cipher suites into its TLS HELLO 🫶. SMTP servers that need to interoperate with opportunistic TLS clients SHOULD be prepared for that, either by always picking a mutually supported non-anonymous cipher suite or by correctly handling client connections that negotiate anonymous cipher suites ✨.

Now the tea 🍵: SMTP server operators are under no obligation to enable anonymous cipher suites, but no security is gained by sending certificates to clients that will ignore them 🙈. Honestly, supporting anonymous cipher suites on the server makes audit trails way more informative 📋. Log entries for connections that used an anonymous cipher suite record the fact that the client didn't care to authenticate the server. Main character logging energy 💅.

9. Operational Considerations 🛠️

9.1. Client Operational Considerations 📬

Picture this 😩: an operational error on the sending or receiving side that can't be fixed in a timely manner may, at times, lead to consistent failure to deliver time-sensitive email. The sending MTA administrator may have to choose between letting email queue until the error is resolved and disabling opportunistic or mandatory DANE TLS (Section 6) for one or more destinations. The choice to disable DANE TLS security should not be made lightly 🥺. Every reasonable effort should be made to figure out whether mail delivery problems are the result of an operational error and not an attack 🕵️‍♀️. A fallback strategy may be to configure explicit out-of-band TLS security settings, if the sending MTA supports that 🦋.

SMTP clients may roll out opportunistic DANE TLS incrementally, enabling it only for selected sites, or may occasionally need to disable opportunistic DANE TLS for peers that fail to interoperate because of misconfiguration or software defects on either end 🔧. Some implementations MAY support DANE TLS in an "audit only" mode, where failure to reach the requisite security level gets logged as a warning and delivery carries on at a reduced security level 📝. Important 🚨: unless local policy specifies "audit only" or says that opportunistic DANE TLS is not to be used for a particular destination, an SMTP client MUST NOT deliver mail via a server whose certificate chain fails to match at least one TLSA record when usable TLSA records are found for that server. No skipping this one, bestie 💖.

9.2. Publisher Operational Considerations 🎀

Some MTAs enable STARTTLS selectively 🤨. For example, they might only support STARTTLS with clients that have previously shown "proper MTA behavior", e.g., by retrying deferred messages (greylisting). If an MTA like that publishes DANE TLSA records, sending MTAs that implement this specification won't attempt the initial cleartext SMTP transaction needed to establish that "proper MTA behavior", because they can't establish the required channel security 😭. Server operators MUST NOT implement selective STARTTLS if they also want to support DANE TLSA 🚫.

TLSA Publishers MUST follow the guidelines in Section 8 of [RFC7671] 📜.

TLSA Publishers SHOULD follow the TLSA publication size guidance found in Section 10.1 of [RFC7671] 📏.

TLSA Publishers SHOULD follow the TLSA record TTL and signature lifetime recommendations found in Section 13 of [RFC7671] ⏰.

10. Security Considerations 🚨

Listen up, this part is SERIOUS 🌈💀.

This protocol leverages DANE TLSA records to implement MITM-resistant Opportunistic Security [RFC7435] for SMTP 🔐. For destination domains that sign their MX records and publish signed TLSA records for their MX hostnames, this protocol lets sending MTAs securely discover both whether TLS is available and how to authenticate the destination 👑.

This protocol does not aim to secure all SMTP traffic, because that isn't practical until DNSSEC and DANE adoption are universal 🌍. The incremental deployment you get by following this specification is the best possible path for securing SMTP ✨. This protocol coexists and interoperates with the existing insecure Internet email backbone 🫶.

The protocol does not preclude existing non-opportunistic SMTP TLS security arrangements. Those can keep being used as before, via manual configuration with negotiated out-of-band key and TLS configuration exchanges 🗝️.

Okay, this is the scary part 😱: opportunistic SMTP TLS depends critically on DNSSEC for downgrade resistance and secure resolution of the destination name. If DNSSEC is compromised, it's not possible to fall back on the public CA PKI to prevent MITM attacks 💀. A successful breach of DNSSEC lets an attacker publish TLSA usage 3 certificate associations, and that bypasses any security benefit the legitimate domain owner might hope to gain by publishing usage 0 or usage 1 TLSA RRs 🥀. Given the lack of public CA PKI support in existing MTA deployments, avoiding certificate usages 0 and 1 simplifies implementation and deployment with no adverse security consequences 🧠.

Implementations must strictly follow Sections 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.2, and 9.1 of this specification 📖. These sections indicate when it's appropriate to initiate a non-authenticated connection or a cleartext connection to an SMTP server. Specifically, to prevent downgrade attacks on this protocol, implementations must not initiate a connection when this specification indicates that a particular SMTP server must be considered unreachable 🛑.

11. References 📚

11.1. Normative References 💅

   [RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
              STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
              <http://www.rfc-editor.org/info/rfc1034>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <http://www.rfc-editor.org/info/rfc2119>.

   [RFC3207]  Hoffman, P., "SMTP Service Extension for Secure SMTP over
              Transport Layer Security", RFC 3207, DOI 10.17487/RFC3207,
              February 2002, <http://www.rfc-editor.org/info/rfc3207>.

   [RFC4033]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
              Rose, "DNS Security Introduction and Requirements",
              RFC 4033, DOI 10.17487/RFC4033, March 2005,
              <http://www.rfc-editor.org/info/rfc4033>.

   [RFC4034]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
              Rose, "Resource Records for the DNS Security Extensions",
              RFC 4034, DOI 10.17487/RFC4034, March 2005,
              <http://www.rfc-editor.org/info/rfc4034>.

   [RFC4035]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
              Rose, "Protocol Modifications for the DNS Security
              Extensions", RFC 4035, DOI 10.17487/RFC4035, March 2005,
              <http://www.rfc-editor.org/info/rfc4035>.

   [RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
              (TLS) Protocol Version 1.2", RFC 5246,
              DOI 10.17487/RFC5246, August 2008,
              <http://www.rfc-editor.org/info/rfc5246>.

   [RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
              Housley, R., and W. Polk, "Internet X.509 Public Key
              Infrastructure Certificate and Certificate Revocation List
              (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
              <http://www.rfc-editor.org/info/rfc5280>.

   [RFC5321]  Klensin, J., "Simple Mail Transfer Protocol", RFC 5321,
              DOI 10.17487/RFC5321, October 2008,
              <http://www.rfc-editor.org/info/rfc5321>.

   [RFC5598]  Crocker, D., "Internet Mail Architecture", RFC 5598,
              DOI 10.17487/RFC5598, July 2009,
              <http://www.rfc-editor.org/info/rfc5598>.

   [RFC6066]  Eastlake 3rd, D., "Transport Layer Security (TLS)
              Extensions: Extension Definitions", RFC 6066,
              DOI 10.17487/RFC6066, January 2011,
              <http://www.rfc-editor.org/info/rfc6066>.

   [RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
              Verification of Domain-Based Application Service Identity
              within Internet Public Key Infrastructure Using X.509
              (PKIX) Certificates in the Context of Transport Layer
              Security (TLS)", RFC 6125, DOI 10.17487/RFC6125,
              March 2011, <http://www.rfc-editor.org/info/rfc6125>.

   [RFC6186]  Daboo, C., "Use of SRV Records for Locating Email
              Submission/Access Services", RFC 6186,
              DOI 10.17487/RFC6186, March 2011,
              <http://www.rfc-editor.org/info/rfc6186>.

   [RFC6672]  Rose, S. and W. Wijngaards, "DNAME Redirection in the
              DNS", RFC 6672, DOI 10.17487/RFC6672, June 2012,
              <http://www.rfc-editor.org/info/rfc6672>.

   [RFC6698]  Hoffman, P. and J. Schlyter, "The DNS-Based Authentication
              of Named Entities (DANE) Transport Layer Security (TLS)
              Protocol: TLSA", RFC 6698, DOI 10.17487/RFC6698,
              August 2012, <http://www.rfc-editor.org/info/rfc6698>.

   [RFC7218]  Gudmundsson, O., "Adding Acronyms to Simplify
              Conversations about DNS-Based Authentication of Named
              Entities (DANE)", RFC 7218, DOI 10.17487/RFC7218,
              April 2014, <http://www.rfc-editor.org/info/rfc7218>.

   [RFC7671]  Dukhovni, V. and W. Hardaker, "The DNS-Based
              Authentication of Named Entities (DANE) Protocol: Updates
              and Operational Guidance", RFC 7671, DOI 10.17487/RFC7671,
              October 2015, <http://www.rfc-editor.org/info/rfc7671>.

11.2. Informative References 🦋

   [RFC1035]  Mockapetris, P., "Domain names - implementation and
              specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
              November 1987, <http://www.rfc-editor.org/info/rfc1035>.

   [RFC2136]  Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound,
              "Dynamic Updates in the Domain Name System (DNS UPDATE)",
              RFC 2136, DOI 10.17487/RFC2136, April 1997,
              <http://www.rfc-editor.org/info/rfc2136>.

   [RFC2181]  Elz, R. and R. Bush, "Clarifications to the DNS
              Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997,
              <http://www.rfc-editor.org/info/rfc2181>.

   [RFC4949]  Shirey, R., "Internet Security Glossary, Version 2",
              FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
              <http://www.rfc-editor.org/info/rfc4949>.

   [RFC6409]  Gellens, R. and J. Klensin, "Message Submission for Mail",
              STD 72, RFC 6409, DOI 10.17487/RFC6409, November 2011,
              <http://www.rfc-editor.org/info/rfc6409>.

   [RFC7435]  Dukhovni, V., "Opportunistic Security: Some Protection
              Most of the Time", RFC 7435, DOI 10.17487/RFC7435,
              December 2014, <http://www.rfc-editor.org/info/rfc7435>.

   [RFC7673]  Finch, T., Miller, M., and P. Saint-Andre, "Using
              DNS-Based Authentication of Named Entities (DANE) TLSA
              Records with SRV Records", RFC 7673, DOI 10.17487/RFC7673,
              October 2015, <http://www.rfc-editor.org/info/rfc7673>.

Okay bestie, this is the final stretch and I'm so ready 💅✨

12. Acknowledgements 🫶

The authors would like to extend great thanks to Tony Finch, who started the original version of a DANE SMTP document. 🌸 His work is greatly appreciated and has been incorporated into this document. The authors would like to additionally thank Phil Pennock for his comments and advice on this document. 💜

Acknowledgements from Viktor: Thanks to Paul Hoffman, who motivated me to begin work on this memo and provided feedback on early draft versions of this document. 🦋 Thanks to Patrick Koetter, Perry Metzger, and Nico Williams for valuable review comments. Thanks also to Wietse Venema, who created Postfix, and whose advice and feedback were essential to the development of the Postfix DANE implementation. 🧚

Authors' Addresses 🎀

Viktor Dukhovni Two Sigma

Email: ietf-dane@dukhovni.org

Wes Hardaker Parsons P.O. Box 382 Davis, CA 95617 United States

Email: ietf@hardakers.net

📦 where this page comes from