Hacker News new | ask | show | jobs
by philipwhiuk 5 days ago
Old version:

* DNS lookup for MX record

New version

* DNS lookup for A record

* HTTP request for .wellknown/htmp/known_hosts

Not sure why this is being considered as an improvement?

> each mailbox of a domain on a different provider

Why is this useful/necessary or even 'good'?
3 comments
rzerowan 5 days ago
Id think its for enduser flexibility and convenience. Its more involved to alter DNS records vs just adding a text line to a webpage and hitting that default endpoint as standard. Same way LetsEncrypt allows the easiest setup with the .wellknown endpoint , where a user may not have DNS access beyond the initial A record setup.
link
inigyou 4 days ago
Why is one more involved than the other? DNS is just a text file too. And you might not even have a web server. Why should mail servers be required to also be web servers? And what if the web server for that domain is already a completely separate system, and now you force it to be linked to the email system?
link
8organicbits 5 days ago
Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.
link
winstonwinston 5 days ago
To be fair, it’s used by only those who choose to use horrendous “mta-sts” instead of DNS-based Authentication of Named Entities (DANE).

I might add that if you want to enforce SMTP TLS, you can do just that without mta-sts or DANE.

link
8organicbits 4 days ago
Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended.

What concerns do you have with MTA-STS?

link
tptacek 4 days ago
So, basically everybody? DANE has virtually no uptake. I think it might literally just be Microsoft at this point?
link
8organicbits 4 days ago
When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.
link
stackskipton 5 days ago
It's not a good idea, I'd call it terrible in fact. We have MX Records, might as well use those. If not, use SRV records. Requiring mail server to involved in root of the domain is terrible idea.
link