What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)?

Secondly, how can I verify that DANE is configured correctly? Either with a local tool or online tool. And are there known Nmap NSE scripts that perform this check?

  • 1
    There are plenty of resources and papers online that do a great job of explaining. – multithr3at3d Jun 30 '16 at 12:38

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate).

From Wikipedia:

DANE enables the administrator of a domain name to certify the keys used in that domain's TLS clients or servers by storing them in the Domain Name System (DNS). DANE needs the DNS records to be signed with DNSSEC for its security model to work.

Here is an online tool that can validate a DANE implementation: https://dane.sys4.de/common_mistakes

  • 4
    Not only the CA, using DANE it is also possible to specifiy the public key(s) which are allowed for the domain or even the full certificate. – Josef Jul 19 '16 at 11:47

The primary goal of DANE is to allow a DNS provider to provide a certificate for a domain as a DNS record. The work performed by a CA now - specifically, domain validation, i.e. matching a public key to a domain - would be done by a DNS provider instead of a CA.

As DNS records are required to be trusted in this scenario, DNSSEC is a requirement for DANE.

  • Partially true, to trust the certificate it must be signed by a 3rd party, in this case you sign the certificate yourself as the DNS operator following the chain from the root, you operate as an intermediate CA, as opposed to signing the certificate with a public certificate trusted root. trustworthy I would disagree, there is no external entity to validate if your certificate is good or malicious. – Jacob Evans May 30 '17 at 12:41
  • 1
    @JacobEvans I've modified my language, as I did not wish to imply that DNS was trustworthy, but merely that DANE trusts DNS and hence the DNSSEC dependency. – mikemaccana May 30 '17 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.