| ▲ | quotemstr 2 hours ago | |
DANE is a live thing in email. MTA-STS likewise uses DNS (unfortunately combined with a well-known HTTP URL path) to denote the equivalent of HSTS without everyone carting around a giant preload list. DKIM's signer-described partial-coverage signatures are pragmatic. DMARC's one-of-two alignment check is good and flexible. BIMI is good. In general, email has used DNS to a greater extent than the web has to build trust mechanisms that don't depend on giant lists managed by a tiny number of browser vendors. | ||
| ▲ | tptacek an hour ago | parent [-] | |
As the RFC says, MTA-STS exists in part to work around the fact that email providers generally don't do DANE. | ||