Why Fastmail Rejects DANE Encryption Despite Its Security Benefits
Understanding Email Encryption
Fastmail explains the layered reality of email encryption: TLS protects the connection to your provider, opportunistic TLS covers server-to-server transit, and disk encryption guards stored mail. MTA-STS and DANE can close the man-in-the-middle gap, but Fastmail favors MTA-STS because DNSSEC failures—like Cloudflare's 2023 outage—can persist in caches for days, and availability matters as much as confidentiality.
Unlike most system failures, DNSSEC errors are uniquely unforgiving: when there's a routing problem, you fix it and service is restored immediately, but when there's a DNSSEC problem, broken records can persist in caches across the internet for hours or days.