* [email protected]: > It is my understanding if you publish DANE and TLSA records not only > must you be using DNSSEC (Which most big companies don't) but then > your mail server will not accept mail from anyone not using TLS 1.2+.
DNSSEC only ensures that DNS responses can be verified against key material, i.e. nameservers cryptographically sign DNS records and the resulting data can be verified. In other words, DNSSEC secures DNS records against manipulation. Whether or not a MTA offers TLS encryption for mail transport, or which ciphers are supported, does not depend on DNSSEC. I like to configure Postfix to accept even "outdated" mechanisms for opportunistic TLS, because any encryption is better than no encryption when it comes to protect mail-related TCP traffic against observers. Does this answer your questions? -Ralph
