Sikker e-mailtransport (STARTTLS og DANE)

STARTTLS ensures that the connection between mail servers is encrypted while an email is being sent. The DANE standard is an extra security check for both web and email. DANE is an identity verification tool that double-checks whether everything is as it should be. Think of a fake driving licence that looks just like a real one – only the licence number will reveal that it is a fake. DANE serves as a registry to verify that the number on the driving licence is real and that it matches the owner of the licence. DANE works closely with the DMARC, DKIM and SPF standards, which should all be enabled.

Why

• "Opportunistic Security: Some Protection Most of the Time" by V. Dukhovni
• "New e-mail security protocols mandatory within government" by Marco Davids (SIDN)
• "The sad state of SMTP encryption" by Filippo Valsorda

Usage statistics

• DANE trend graphs
• DANE statistics
• .nl statistics on DANE by SIDN Labs
• Google's statistics on STARTTLS

Background information

• How-to on 'DANE for SMTP' by Dutch Internet Standards Platform
• Wiki on 'DANE for SMTP'
• FAQ on e-mail security standards by SIDN
• Factsheet "Secure the connections of mail servers" by NCSC-NL
• "IT Security Guidelines for Transport Layer Security (TLS), v2.1" by NCSC-NL

Specifications

• RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security
• RFC 7672: SMTP Security via Opportunistic DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS)
• RFC 7671: The DNS-Based Authentication of Named Entities (DANE) Protocol: Updates and Operational Guidance