On: Calling time on DNSSEC: The costs exceed the benef...

[redprince]

> DANE isn't happening. Browsers tried a decade ago and gave up

DANE was never limited to browsers. Example:

https://ssl-tools.net/mailservers/proton.me

Though support in that space is very patchy as well and maybe going nowhere. In any case, it serves as an example that DNSSEC can be built upon, even if the new ideas don't necessarily make it.

[tptacek → redprince]

The major mail vendors came up with MTA-STS specifically to avoid having to roll out DNSSEC.