Comment

Comment by tptacek

This is great news. It's worth noting: the subtext behind MTA-STS (actually made explicit at one point in the RFC) is that it works without DNSSEC and DANE, which major mail providers weren't adopting (for good reason).

Since breaking SMTP TLS MITM was one of the few remaining things DNSSEC could help with that didn't have answers in other protocols, this is a major blow to any impetus to roll DNSSEC out in the future. Between MTA-STS, DNS-over-HTTPS/TLS, and certificate transparency, I think DNSSEC is essentially moribund now.

parent tptacek 7 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton