#rfc7672 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #rfc7672, aggregated by home.social.
-
DANE (RFC 7672) publishes your mail server's TLS certificate fingerprint as a TLSA record in DNSSEC-signed DNS.
no certificate authority trust chain required. the trust anchor is DNS itself.
```
_25._tcp.mail.yourdomain.com. IN TLSA 3 1 1 <SHA-256 hash>
```the prerequisite: your domain must be DNSSEC-signed.
without DNSSEC, DANE records can be spoofed, which defeats the purpose.
-
DANE (RFC 7672) publishes your mail server's TLS certificate fingerprint as a TLSA record in DNSSEC-signed DNS.
no certificate authority trust chain required. the trust anchor is DNS itself.
```
_25._tcp.mail.yourdomain.com. IN TLSA 3 1 1 <SHA-256 hash>
```the prerequisite: your domain must be DNSSEC-signed.
without DNSSEC, DANE records can be spoofed, which defeats the purpose.