We have spent a lot of time on X.509 Certificates and the Trust Chain of CAs. But as we saw in Module 2, the CA system is fragile—if one CA is compromised, the whole system is at risk. DANE (DNS-based Authentication of Named Entities) is a radical alternative: it uses DNSSEC to verify TLS certificates, effectively making DNS the 'Certificate Authority'.
DANE uses a special DNS record called `TLSA`. This record allows a domain owner to say: 'The only valid certificate for this website is the one with this specific public key.' Because the `TLSA` record is signed with DNSSEC, the client knows it can trust the key. The client then connects via TLS and checks if the server's certificate matches the key in the DNS.
💡 The revolutionary part: With DANE, you no longer need a third-party CA like DigiCert or Let's Encrypt. You can use your own self-signed certificate, and as long as its hash is in your DNSSEC-signed TLSA record, it is trusted.
# Conceptual TLSA record
_443._tcp.example.com. IN TLSA 3 1 1 [Hash of Public Key]The TLSA record has three fields: the usage (how to use the key), the selector (which part of the cert to hash), and the matching type (is it a full cert or just a public key?).
⚠️ DANE is not yet widely supported by web browsers (Chrome, Firefox). It is primarily used by Email servers (SMTP) to prevent spoofing and interception of mail.
| Feature | Traditional CA (X.509) | DANE |
|---|---|---|
| Trust Anchor | Root CAs in OS Store | DNS Root Trust Anchor |
| Verification | CA Signature | DNSSEC Signature |
| Cost | Often Paid / Automated | Free (part of DNS) |
| Centralization | Highly Centralized | Decentralized (Domain Owner) |
The biggest success of DANE is in email. Traditionally, email servers used 'Opportunistic TLS'—they tried to encrypt, but if it failed, they sent in cleartext. With DANE, a mail server can publish a TLSA record. The sending server *must* verify the certificate against the DNS record. If they don't match, the mail is not sent, preventing a massive class of MitM attacks on email.
If you misconfigure your TLSA record and then rotate your TLS certificate, you will la la l a block all incoming traffic. DANE is a 'hard-fail' system.
Verify exercises to earn ★ 180 XP and unlock next lab level.