Learn about DMARC, SPF, and DKIM

Rotating an SMTP certificate is usually a routine maintenance task. Rotating a certificate on a DANE-protected MX is different because the certificate and the DNS TLSA record are two halves of the same authentication decision.

Change the service first and a sender with cached TLSA data can reject...

DANE can make inbound SMTP resistant to certificate substitution and STARTTLS downgrade attacks. It can also turn a small DNS or certificate mistake into a growing queue of delayed mail.

That is not a reason to avoid DANE. It is a reason to deploy it as a mail-routing change, not as a single TLS c...

When another mail server delivers a message to your domain, STARTTLS can encrypt the connection. Without an additional policy, that encryption is usually opportunistic: the sender tries TLS, but a network attacker may be able to remove the STARTTLS capability or redirect the SMTP connection to ano...