Remix.run Logo
▲ quotemstr 2 hours ago

DANE is a live thing in email. MTA-STS likewise uses DNS (unfortunately combined with a well-known HTTP URL path) to denote the equivalent of HSTS without everyone carting around a giant preload list. DKIM's signer-described partial-coverage signatures are pragmatic. DMARC's one-of-two alignment check is good and flexible. BIMI is good.

In general, email has used DNS to a greater extent than the web has to build trust mechanisms that don't depend on giant lists managed by a tiny number of browser vendors.

▲tptacek an hour ago | parent [-]

As the RFC says, MTA-STS exists in part to work around the fact that email providers generally don't do DANE.