[winstonwinston]

To be fair, it’s used by only those who choose to use horrendous “mta-sts” instead of DNS-based Authentication of Named Entities (DANE).

I might add that if you want to enforce SMTP TLS, you can do just that without mta-sts or DANE.

[8organicbits]

Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended.

What concerns do you have with MTA-STS?

[tptacek]

So, basically everybody? DANE has virtually no uptake. I think it might literally just be Microsoft at this point?

[8organicbits]

When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.