DANE / MTA-STS support

[Stefan-MyBB]

Are there plans to support DANE and/or MTA-STS?

Google already supports MTA-STS and Microsoft has announced support for DANE.

[andris9]

MTA-STS is planned, no ETA though. DANE is not planned, mostly because Node.js does not natively support resolving TLSA records.

[titanism]

See nodejs/node#39569 (comment). You can do this with 🍊 Tangerine.

const Tangerine = require('tangerine');

const tangerine = new Tangerine();

console.log(await tangerine.resolveTlsa('_25._tcp.internet.nl'));

[
  {
    cert: Buffer @Uint8Array [
      e1ae9c3d e848ece1 ba72e0d9 91ae4d0d 9ec547c6 bad1ddda b9d6beb0 a7e0e0d8
    ],
    mtype: 1,
    name: 'proloprod.mail._dane.internet.nl',
    selector: 1,
    ttl: 622,
    usage: 2,
  },
  {
    cert: Buffer @Uint8Array [
      d6fea64d 4e68caea b7cbb2e0 f905d7f3 ca3308b1 2fd88c5b 469f08ad 7e05c7c7
    ],
    mtype: 1,
    name: 'proloprod.mail._dane.internet.nl',
    selector: 1,
    ttl: 622,
    usage: 3,
  },
]

[titanism]

c-ares going to support this soon, see nodejs/node#39569 (comment)

[titanism]

resolveTsla being added

nodejs/node#39569 (comment)

nodejs/node@ef91595

[titanism]

Can you re-open?

[andris9]

Once resolveTsla is in Node LTS, then we could consider it. In general DANE support has 0 priority, I see no value at all in it. MTA-STS is already supported.

[louis-lau]

I would like to see it at one point as well, as MTA-STS seems to have been superseded by DANE in the eyes of some, which I don't really agree with tbh. But especially because there's no preload list (https://www.eff.org/deeplinks/2020/04/winding-down-starttls-everywhere-project-and-future-secure-email), DANE is a lot more secure.

So I could see a future where recipients implement DANE and not MTA-STS, so the need to check both would be there. And if someone does both, DANE will be more secure and MTA-STS more like a fallback.

But yeah, it's not possible until it's in node LTS at the very least, and if implemented then it would force a version update for everyone. Might not be a problem, but worth thinking about :). Always need to have a lot of patience watching for progress in the world of email haha

[andris9]

Well, yeah, once TLSA is available in Node LTS then there is no reason not to support DANE anymore.

[titanism]

dns.resolveTlsa added in Node v23.9.0, v22.15.0 @ https://nodejs.org/api/dns.html#dnsresolvetlsahostname-callback

As of February 1, 2026, the active Node.js Long-Term Support (LTS) versions are Node.js v24 (Krypton) and Node.js v22 (Jod). Node.js v20 (Iron) is in maintenance mode.

[titanism]

This belongs in mx-connect, not in this project. Will open a PR there.

[titanism]

I've submitted a PR to add DANE support to underlying package used mx-connect (which also is used for MTA-STS)

zone-eu/mx-connect#22

This supports older versions of Node as well that don't have the method, via tangerine