In the scenario with two domain names
example.comsecured with DNSSEC
example.orgnot secured with DNSSEC
and a mail service running at
I want to secure the mail service using TLSA/DANE. Is this somehow possible and can I expect this to work for most DANE aware software?
The idea is to publish a TLSA record
_25._tcp.smtp.example.com and a CNAME record
smtp.example.com that points to
The response from the
org zone cannot be trusted because it's not DNSSEC secure, but the TLSA record from
com can. Is this a reasonable way to enroll DANE for zones that are not yet DNSSEC ready?
Update: I just found this in section 7 of rfc7671:
The complexity of coordinating key management is largely eliminated when DANE TLSA records are found in the Service Provider's domain, as discussed in Section 6. Therefore, DANE TLS clients connecting to a server whose domain name is a CNAME alias SHOULD follow the CNAME "hop by hop" to its ultimate target host (noting at each step whether or not the CNAME is DNSSEC validated). If at each stage of CNAME expansion the DNSSEC validation status is "secure", the final target name SHOULD be the preferred base domain for TLSA lookups.
So in my case the the validation status is not "secure" and the rfc continues with:
Implementations failing to find a TLSA record using a base name of the final target of a CNAME expansion SHOULD issue a TLSA query using the original destination name. That is, the preferred TLSA base domain SHOULD be derived from the fully expanded name and, failing that, SHOULD be the initial domain name.
The client 'should' eventually resolve the initial domain name, but I'm not sure if that actually happens in most cases.