bonus.dane
DANE/TLSA Validated
What we check
We verify that the MX hostname has DNSSEC-signed TLSA records that match the server's live TLS certificate. This bonus finding is emitted in the Bonus category when DANE validation succeeds.
What this finding means
The domain has deployed DANE — a DNSSEC-authenticated TLSA record that matches the mail server's certificate. This is the strongest form of SMTP transport security, providing certificate verification independent of the public CA system.
Why it matters
- Highest trust tier. DANE is the gold standard for authenticated SMTP encryption. It prevents both certificate-stripping MITM attacks and forged-certificate attacks.
- DNSSEC chain of trust. The certificate binding is secured by DNSSEC, not by a commercial CA. A compromised CA cannot issue a certificate that passes DANE verification.
- Bonus recognition. Valid DANE contributes positively to the overall score, recognizing the significant effort required to deploy both DNSSEC and correct TLSA records.
Evidence example
TLSA record: 3 1 1 a1b2c3d4e5f6... (DANE-EE, SPKI, SHA-256)
DNSSEC: validated
Certificate match: ✓
DANE validated — bonus awarded