DNS-based Authentication of Named Entities

From Wikipedia, the free encyclopedia
Jump to: navigation, search
"DANE" redirects here. For the Colombian department of statistics, see National Administrative Department of Statistics.

DNS-based Authentication of Named Entities (DANE) is a protocol to allow X.509 certificates, commonly used for Transport Layer Security (TLS), to be bound to DNS names using Domain Name System Security Extensions (DNSSEC).[1]

It is proposed in RFC 6698 as a way to authenticate TLS client and server entities without a certificate authority (CA).


TLS/SSL encryption is currently based on certificates issued by certificate authorities (CAs). Within the last few years, a number of CA providers suffered serious security breaches, allowing the issuance of certificates for well-known domains to those who don't own those domains. Trusting a large number of CAs might be a problem because any breached CA could issue a certificate for any domain name. DANE enables the administrator of a domain name to certify the keys used in that domain's TLS clients or servers by storing them in the Domain Name System (DNS). DANE needs DNS records to be signed with DNSSEC.

Additionally DANE allows a domain owner to specify which CA is allowed to issue certificates for a particular resource, which solves the problem of any CA being able to issue certificates for any domain.






  • RFC 6394 Use Cases and Requirements for DNS-Based Authentication of Named Entities (DANE)
  • RFC 6698 The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
  • RFC 7218 Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)


  1. ^ "DANE: Taking TLS Authentication to the Next Level Using DNSSEC". ISOC. 
  2. ^ Adam Langley (2012-10-20). "DANE stapled certificates". ImperialViolet. Retrieved 2014-04-16. 
  3. ^ Adam Langley (2011-06-16). "DNSSEC authenticated HTTPS in Chrome". ImperialViolet. Retrieved 2014-04-16. 
  4. ^ How To Add DNSSEC Support To Google Chrome
  5. ^ DNSSEC Validator - Chrome add-on
  6. ^ "DNSSEC/TLSA Validator". 
  7. ^ "[irssi] Commit d826896f74925f2e77536d69a3d1a4b86b0cec61". github.com. Retrieved 2014-07-18. 
  8. ^ "Postfix TLS Support". Postfix.org. Retrieved 2014-04-16. 
  9. ^ posteo.de. "Posteo unterstützt DANE/TLSA" (in German). Retrieved 2014-05-15. 
  10. ^ mailbox.org. "DANE und DNSsec für sicheren E-Mail-Versand bei mailbox.org" (in German). Retrieved 2014-05-29. 
  11. ^ dotplex.de. "Secure Hosting mit DANE/TLSA" (in German). Retrieved 2014-06-21. 
  12. ^ mail.de. "mail.de unterstützt DANE/TLSA - Kein Beitritt in Verbund "E-Mail made in Germany"" (in German). Retrieved 2014-06-22. 
  13. ^ tutanota.de. "DANE Everywhere?! Let’s Make the Internet a Private Place Again." (in German). Retrieved 2015-01-13. 
  14. ^ "Verifying a certificate using DANE (DNSSEC)". Gnu.org. 
  15. ^ Bug #77327 for Net-DNS: DANE TLSA support, rt.cpan.org 
  16. ^ Net_DNS2 v1.2.5 – DANE TLSA Support 

See also[edit]

External links[edit]